CreateQueryObjectHandle
FreeQueryObject
GetHisiAgentVersionInfo
RegisterGetDevCallBackFunc
RegisterGetDevCallBackFuncEx
StartQueryDev
Static task
static1
Behavioral task
behavioral1
Sample
40eb57ae6d3433a9840602376d3e30ffd493d62557ae67130594544d3e7fd4ec.dll
Resource
win7-20231129-en
Target
40eb57ae6d3433a9840602376d3e30ffd493d62557ae67130594544d3e7fd4ec
Size
59KB
MD5
acb3960b616f3194bab7c6997bdfe1ae
SHA1
09cea34ab57ad6be064166dbceb71dc20d626c01
SHA256
40eb57ae6d3433a9840602376d3e30ffd493d62557ae67130594544d3e7fd4ec
SHA512
eb808b0673fd914948d454ffc1c8fbd837ec8b95cc91ca060464e10be6da32649f7612eb70c3030f73c9aa9436410116fc24b93807a7757a457973eda945ecc7
SSDEEP
768:5pIcFo7LE72qe72ax8/ksHbTdhXEPt9O3amHpQRL+AYzOEHTL8MF5PaDp1ur29O:5pE/Gde2wQHbh8t5mJoSAALBF5Peuri
Checks for missing Authenticode signature.
Processes:
resource |
---|
40eb57ae6d3433a9840602376d3e30ffd493d62557ae67130594544d3e7fd4ec |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
SetupDiGetClassDevsA
SetupDiGetDeviceRegistryPropertyA
SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
GetTickCount64
GetCurrentThreadId
WaitForSingleObject
GetLastError
DisableThreadLibraryCalls
CloseHandle
GetModuleHandleExA
FreeLibrary
GetModuleFileNameA
GetSystemTimeAsFileTime
GetProcAddress
LoadLibraryA
GetVersionExA
OutputDebugStringA
GetTickCount
TerminateThread
Sleep
CreateThread
IsProcessorFeaturePresent
IsDebuggerPresent
DecodePointer
EncodePointer
QueryPerformanceCounter
RegOpenKeyExA
RegEnumKeyExA
RegQueryValueExA
RegCloseKey
?_Syserror_map@std@@YAPBDH@Z
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
?_Winerror_map@std@@YAPBDH@Z
memmove
_purecall
??2@YAPAXI@Z
memchr
vsprintf_s
free
tolower
strncmp
??_V@YAXPAX@Z
printf
_stricmp
atoi
??1type_info@@UAE@XZ
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
__CppXcptFilter
_amsg_exit
_malloc_crt
_initterm
_initterm_e
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
?terminate@@YAXXZ
_except_handler4_common
__clean_type_info_names_internal
memset
_CxxThrowException
__CxxFrameHandler3
memcpy
??3@YAXPAX@Z
bind
connect
__WSAFDIsSet
closesocket
send
WSAStartup
ioctlsocket
select
htons
WSACleanup
socket
recv
CreateQueryObjectHandle
FreeQueryObject
GetHisiAgentVersionInfo
RegisterGetDevCallBackFunc
RegisterGetDevCallBackFuncEx
StartQueryDev
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ