DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
c3196d51fbd51335853c8556c076a21b.dll
Resource
win7-20240221-en
Target
c3196d51fbd51335853c8556c076a21b
Size
56KB
MD5
c3196d51fbd51335853c8556c076a21b
SHA1
8d275c4248f05e3cd0568307a860c921bdb60328
SHA256
e3cc806ea1ea1af9ea7022437fc0dc16ba74e8194940122aba654de75c7ea1c4
SHA512
79275f4f8879a2a075b3e3f233d8b1eedf51440c5e97efa99958eb214db383b22e8f49a002ce41896e355b7117069e39bf2b4e1f73d22af5f82357c3066fec8b
SSDEEP
768:/w7JeFaFMo+xy3BMQ6L0J1V+nbZZ0JVFaPflGzCM3VskttavYFRuUxs8EKl6YXi:Y7g8FSerdAok3y3VzTFRuUBEKFX
Checks for missing Authenticode signature.
resource |
---|
c3196d51fbd51335853c8556c076a21b |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
WideCharToMultiByte
lstrlenW
GetModuleFileNameA
CreateThread
ExitProcess
GetCommandLineW
CloseHandle
GetSystemDirectoryA
DisableThreadLibraryCalls
InitializeCriticalSection
lstrlenA
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
Process32Next
Process32First
WritePrivateProfileStringA
GetExitCodeProcess
WaitForSingleObject
GetCurrentProcessId
FindFirstFileA
GetPrivateProfileStringA
FindNextFileA
CreateDirectoryA
CreateProcessA
EnterCriticalSection
LeaveCriticalSection
LocalFree
GetProcAddress
Sleep
MultiByteToWideChar
SetFileAttributesA
DeleteFileA
MoveFileA
LoadLibraryA
FreeLibrary
DeleteCriticalSection
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteKeyA
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoInitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoUninitialize
CoCreateInstance
SysStringLen
LoadRegTypeLi
VariantClear
SysAllocString
SysFreeString
fclose
_stricmp
_strlwr
_adjust_fdiv
malloc
_initterm
free
_wcslwr
wcsstr
_purecall
strcmp
memcpy
memcmp
_access
strrchr
strcat
sprintf
strlen
strncpy
strchr
memset
strncmp
strcpy
??3@YAXPAX@Z
atoi
strstr
_strupr
fread
??2@YAPAXI@Z
ftell
fseek
fopen
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ