ResetSSDT
ServiceMain
Behavioral task
behavioral1
Sample
650c3bed4f0049cee48bd733bc423049.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
650c3bed4f0049cee48bd733bc423049.dll
Resource
win10v2004-20231215-en
Target
650c3bed4f0049cee48bd733bc423049
Size
88KB
MD5
650c3bed4f0049cee48bd733bc423049
SHA1
34e4fc5ec4e1a267ef954da35eecd8cacd06c3c6
SHA256
ae7eca83d6e1f38f3e65d2e223fe81de183f1c53535d145fa3732a0c6a964ff1
SHA512
0a668e3d5443277b9d5a1b040b0836aa020320c13b5967ea48589a983834c7ed4ef644a653f39c931dcaedccfc01962c80959c584f5d8223bf07121de6a1df18
SSDEEP
1536:Z2YGwba5kbb8Gc5kJfxCsfBIZmwksoDb:ZZGwr/8GukJxCsZIZmwksoD
resource | yara_rule |
---|---|
sample | family_gh0strat |
Checks for missing Authenticode signature.
resource |
---|
650c3bed4f0049cee48bd733bc423049 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetFileAttributesA
GetTempPathA
TerminateThread
MoveFileExA
GetTickCount
GetLocalTime
GetModuleHandleA
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
GetStartupInfoA
CreatePipe
DisconnectNamedPipe
TerminateProcess
PeekNamedPipe
WaitForMultipleObjects
SizeofResource
LoadResource
FindResourceA
DeviceIoControl
LoadLibraryExA
SetFileAttributesA
WriteFile
GetSystemDirectoryA
GetCurrentThreadId
GetCurrentProcess
ReleaseMutex
OpenEventA
SetErrorMode
CreateMutexA
SetUnhandledExceptionFilter
FreeConsole
LocalSize
OpenProcess
Process32Next
Process32First
lstrcmpiA
SetFilePointer
ReadFile
CreateFileA
SetLastError
GetLastError
CreateToolhelp32Snapshot
MoveFileA
GetFileSize
RemoveDirectoryA
LocalAlloc
FindFirstFileA
LocalReAlloc
FindNextFileA
LocalFree
FindClose
GetLogicalDriveStringsA
GetVolumeInformationA
GetDiskFreeSpaceExA
GetDriveTypeA
CreateProcessA
DeleteFileA
GetVersionExA
GetPrivateProfileStringA
lstrcmpA
WideCharToMultiByte
MultiByteToWideChar
LoadLibraryA
GetProcAddress
FreeLibrary
GetWindowsDirectoryA
lstrcatA
GetPrivateProfileSectionNamesA
lstrlenA
Sleep
CancelIo
InterlockedExchange
SetEvent
ResetEvent
lstrcpyA
WaitForSingleObject
CloseHandle
CreateEventA
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
VirtualFree
DeleteCriticalSection
InitializeCriticalSection
PostMessageA
OpenDesktopA
GetThreadDesktop
GetUserObjectInformationA
OpenInputDesktop
SetThreadDesktop
CreateWindowExA
IsWindowVisible
GetWindowThreadProcessId
ExitWindowsEx
GetProcessWindowStation
OpenWindowStationA
SetProcessWindowStation
CloseWindowStation
GetCursorPos
ReleaseDC
GetDesktopWindow
CloseWindow
IsWindow
EnumWindows
wsprintfA
GetWindowTextA
GetActiveWindow
GetKeyNameTextA
GetFocus
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
SystemParametersInfoA
SendMessageA
CloseDesktop
GetDC
GetSystemMetrics
SetRect
GetClipboardData
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
mouse_event
SetCursorPos
WindowFromPoint
SetCapture
MapVirtualKeyA
keybd_event
GetPaletteEntries
SelectObject
DeleteObject
DeleteDC
BitBlt
CreateHalftonePalette
CreateCompatibleDC
CreateDIBSection
GetTokenInformation
LookupAccountSidA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
SetServiceStatus
RegisterServiceCtrlHandlerExA
StartServiceA
IsValidSid
LookupAccountNameA
LsaClose
LsaRetrievePrivateData
LsaOpenPolicy
LsaFreeMemory
RegCloseKey
RegQueryValueA
RegOpenKeyExA
CloseServiceHandle
DeleteService
ControlService
QueryServiceStatus
OpenServiceA
OpenSCManagerA
RegSetValueExA
RegCreateKeyA
RegQueryValueExA
RegOpenKeyA
CloseEventLog
ClearEventLogA
OpenEventLogA
SHGetSpecialFolderPathA
SHGetFileInfoA
SHDeleteKeyA
??1type_info@@UAE@XZ
__dllonexit
free
_initterm
_adjust_fdiv
calloc
_beginthreadex
wcstombs
atoi
_strcmpi
realloc
strncpy
_except_handler3
strrchr
malloc
strchr
_CxxThrowException
??2@YAPAXI@Z
__CxxFrameHandler
_onexit
strstr
_ftol
ceil
memmove
??3@YAXPAX@Z
setsockopt
gethostbyname
socket
gethostname
connect
htons
getsockname
WSAStartup
send
select
closesocket
recv
ntohs
WSACleanup
??1_Winit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_Xran@std@@YAXXZ
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
MakeSureDirectoryPathExists
ImmReleaseContext
ImmGetContext
ImmGetCompositionStringA
InternetOpenUrlA
InternetReadFile
InternetCloseHandle
InternetOpenA
URLDownloadToFileA
capGetDriverDescriptionA
capCreateCaptureWindowA
EnumProcessModules
GetModuleFileNameExA
WTSFreeMemory
WTSQuerySessionInformationA
ResetSSDT
ServiceMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ