__KeAttachProcess@4
__KeDetachProcess@0
__KeStackAttachProcess@4
Static task
static1
Behavioral task
behavioral1
Sample
75f27d8fddcc53fd67587664701dc814.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
75f27d8fddcc53fd67587664701dc814.dll
Resource
win10v2004-20231215-en
Target
75f27d8fddcc53fd67587664701dc814
Size
42KB
MD5
75f27d8fddcc53fd67587664701dc814
SHA1
c67630002d1776e4c85ddda6a91dc246a37f26cf
SHA256
e2c9510d3278b3b088a863df47bf3ad6964ea72a0622c7e626e3d21f705aaed8
SHA512
c8c9a4a4f09d30db7b90099e3c161e38b9df544d0e0f12d7c48db14bbc89234a201fc70c60ada16f45899fa2cf9ec8f4e0169a1b1291aaff42e98e5ce7d381a0
SSDEEP
768:TS9zhmFxbfd0mSTfc64CXGXYP1Z3a043zP20GSlGAL2oHFEi/pWGA20RGKW5IJNb:TSHmFx2mqfh4CGQ74S0NAcEi/Yxzwp5k
Checks for missing Authenticode signature.
resource |
---|
75f27d8fddcc53fd67587664701dc814 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
SeLockSubjectContext
SeReleaseSubjectContext
SeCaptureSubjectContext
MmIsDriverVerifying
SeUnlockSubjectContext
VerSetConditionMask
IoGetRelatedDeviceObject
RtlUnicodeStringToAnsiString
RtlInsertElementGenericTableFull
RtlInitString
RtlDeleteElementGenericTable
RtlCompareString
_wcslwr
ZwOpenDirectoryObject
ZwSetEvent
_vsnwprintf
RtlFreeAnsiString
RtlCopyString
RtlEqualString
strrchr
KeTickCount
wcsspn
DbgPrintEx
RtlInitializeGenericTable
memset
__KeAttachProcess@4
__KeDetachProcess@0
__KeStackAttachProcess@4
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ