DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
48bd231e95c8ea9f601b6a7153e4b465.dll
Resource
win7-20231129-en
Target
48bd231e95c8ea9f601b6a7153e4b465
Size
64KB
MD5
48bd231e95c8ea9f601b6a7153e4b465
SHA1
91e8df0e34f6f80da357b240be7bca7ea81d6fa3
SHA256
e863b66b821e6e47039f9313bc2c69749957fba262ab408fa4b49dea58a0536e
SHA512
85d61e1238074a375066bb9546d0174c94dd04c547cf0b8f08478b829440d114669410974dd1ecf3680bad55c303d846f00a5177877331f2a450cd87223e0b57
SSDEEP
1536:UcE0Q2UtJTA4CEEAghKqHnGCsB0guWne:U2UtJAdjmFB0BWne
Checks for missing Authenticode signature.
resource |
---|
48bd231e95c8ea9f601b6a7153e4b465 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
FindNextFileA
DeleteFileA
SetFileAttributesA
GetPrivateProfileStringA
FindFirstFileA
CloseHandle
DeleteCriticalSection
CreateDirectoryA
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
GetSystemDirectoryA
ExitProcess
GetCurrentProcessId
MoveFileA
CreateThread
Process32Next
Process32First
RemoveDirectoryA
InitializeCriticalSection
DisableThreadLibraryCalls
GetCommandLineW
WritePrivateProfileStringA
LocalFree
GetModuleFileNameA
lstrlenW
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
GetProcAddress
FreeLibrary
LoadLibraryA
Sleep
RegEnumKeyExA
RegDeleteKeyA
RegQueryValueExA
RegOpenKeyExA
RegQueryInfoKeyA
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
SHGetSpecialFolderPathA
CommandLineToArgvW
CoUninitialize
CoInitialize
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoCreateInstance
VariantClear
SysStringLen
LoadRegTypeLi
SysAllocString
SysFreeString
??2@YAPAXI@Z
_stricmp
_strlwr
_adjust_fdiv
malloc
_initterm
free
strcmp
strncmp
strncpy
_access
_wcslwr
wcsstr
fopen
fseek
ftell
atoi
strchr
sprintf
??3@YAXPAX@Z
memcmp
memset
memcpy
strlen
strstr
_purecall
_strupr
strrchr
strcat
strcpy
fclose
fread
SHDeleteValueA
SHDeleteKeyA
SHSetValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ