HookAllProcesses
HookAllProcesses2
InitHookAPI
NTHookProcess
NTHookProcess2
NTInjectDll
NTUnInjectDll
NTUnhookProcess
NTUnhookProcess2
UnhookAllProcesses
Behavioral task
behavioral1
Sample
ca9f8a1f502191f086bd280387fa6b90.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ca9f8a1f502191f086bd280387fa6b90.dll
Resource
win10v2004-20240226-en
Target
ca9f8a1f502191f086bd280387fa6b90
Size
40KB
MD5
ca9f8a1f502191f086bd280387fa6b90
SHA1
e2643e1b9f547113932f924754a6deb759e84c3b
SHA256
15b69ff6a9152cdbc30483b4be99c8e6d56ebf5fcc23fb30b2c06b31b31daaf6
SHA512
f7172cc88aecdcca03fbc0b710bb6000a4ee853e60996f6ab8d1d1d54bc6a0e4f310d6bb5b76dbbc6dbabb4bb4032b1a718a3ae91cf4238e6caa5d91f0bef09c
SSDEEP
768:csz+dkO4w7FTZg9v+s5qRbjj/4M5N7wR:gb4CFTZgR+sYRbjjA+eR
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
ca9f8a1f502191f086bd280387fa6b90 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
TlsGetValue
GetStdHandle
CloseHandle
GetLastError
GetCurrentProcess
OpenProcess
GetModuleFileNameA
FreeLibrary
GetProcAddress
LoadLibraryA
WriteProfileStringA
GetExitCodeThread
WaitForSingleObject
VirtualFreeEx
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
GetModuleHandleA
CreateThread
CreateEventA
SetEvent
GetVersionExA
ResetEvent
VirtualFree
HeapFree
GetCommandLineA
GetVersion
GetCPInfo
GetACP
GetOEMCP
ExitProcess
TerminateProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
MultiByteToWideChar
SetHandleCount
LCMapStringA
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualAlloc
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
LCMapStringW
GetStringTypeA
GetStringTypeW
HeapAlloc
HeapReAlloc
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
wsprintfA
DestroyWindow
DefWindowProcA
CreateWindowExA
RegisterClassA
HookAllProcesses
HookAllProcesses2
InitHookAPI
NTHookProcess
NTHookProcess2
NTInjectDll
NTUnInjectDll
NTUnhookProcess
NTUnhookProcess2
UnhookAllProcesses
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE