COMResModuleInstance
DriverProc
KsCreateAllocator
KsCreatePin
KsCreateTopologyNode
ServerMain
modMessage
modmCallback
Static task
static1
Behavioral task
behavioral1
Sample
031aa74291c3b6dfaf8e0449dc9e5e71bf658aca4b5b7a23a03916d53a2aff7a.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
031aa74291c3b6dfaf8e0449dc9e5e71bf658aca4b5b7a23a03916d53a2aff7a.dll
Resource
win10v2004-20240226-en
Target
031aa74291c3b6dfaf8e0449dc9e5e71bf658aca4b5b7a23a03916d53a2aff7a
Size
33KB
MD5
6fc5db1c031484c5babf2acf4d9a3d79
SHA1
53c480ee14db3cfba67402d170c100ccb102ceb8
SHA256
031aa74291c3b6dfaf8e0449dc9e5e71bf658aca4b5b7a23a03916d53a2aff7a
SHA512
307d672ed753f2a0f480814bfb4e856621b4a0be3024ccd1f27b4a347a9bc3caa73c47f2aca91c068c824e8f08bfdcb7c60d9a6194cc30f2ba58cd681e395079
SSDEEP
768:I9qeula2iuu4enYOE7IOIoSYhqD6RBu6J:I9qeulu4eYj7IOI2kGRB7J
Checks for missing Authenticode signature.
resource |
---|
031aa74291c3b6dfaf8e0449dc9e5e71bf658aca4b5b7a23a03916d53a2aff7a |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DeleteFileA
GetSystemDirectoryA
Sleep
CreateThread
GetFileAttributesA
WaitForSingleObject
SetFilePointer
GetLastError
CreateEventA
GetModuleFileNameA
GetTempPathA
GlobalLock
SetFileAttributesA
GetCommandLineA
GlobalUnlock
GlobalFree
LoadLibraryA
GetProcAddress
GlobalAlloc
VirtualProtect
ExitProcess
MultiByteToWideChar
IsBadReadPtr
GetCurrentDirectoryA
GetPrivateProfileStringA
CreateFileA
GetFileSize
ReadFile
CloseHandle
WideCharToMultiByte
GetWindowsDirectoryA
WriteFile
GetParent
GetWindowThreadProcessId
EnumWindows
wsprintfA
GetWindowTextA
ReleaseDC
GetWindowRect
GetDC
GetDesktopWindow
GetClientRect
CallWindowProcA
GetClassNameA
SetWindowLongA
RegisterShellHookWindow
RegisterWindowMessageA
CreateDCA
GetDeviceCaps
DeleteObject
BitBlt
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
GetDIBits
RealizePalette
SelectPalette
GetStockObject
GetObjectA
DeleteDC
GdipCloneImage
GdipAlloc
GdipFree
GdipGetImageEncodersSize
GdipGetImageEncoders
GdiplusStartup
GdipDisposeImage
GdiplusShutdown
GdipSaveImageToFile
GdipLoadImageFromFile
??0_Lockit@std@@QAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??0Init@ios_base@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
WSAStartup
send
recv
socket
inet_addr
htons
connect
gethostbyname
inet_ntoa
closesocket
WSACleanup
InternetOpenUrlA
InternetCloseHandle
InternetReadFile
InternetOpenA
strrchr
_access
strcat
strchr
strncpy
abs
malloc
wcscmp
free
__dllonexit
_onexit
_initterm
_adjust_fdiv
_stricmp
_getpid
_strlwr
_strrev
memcpy
__CxxFrameHandler
strcmp
strstr
atoi
wcslen
wcscpy
strcpy
sprintf
??2@YAPAXI@Z
memset
strlen
Netbios
COMResModuleInstance
DriverProc
KsCreateAllocator
KsCreatePin
KsCreateTopologyNode
ServerMain
modMessage
modmCallback
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ