CreateProcessNotify
bthuoice
Static task
static1
Behavioral task
behavioral1
Sample
d41ab78ff7ca755acd6d872dbbab290b.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d41ab78ff7ca755acd6d872dbbab290b.dll
Resource
win10v2004-20240226-en
Target
d41ab78ff7ca755acd6d872dbbab290b
Size
50KB
MD5
d41ab78ff7ca755acd6d872dbbab290b
SHA1
7355fdbb6ed37d6c696f02b1b9a0f4ebb98313b1
SHA256
31d6dda9d2a5f9d5eb23ea67f5b5e64944ba2a9c0f96e11d6b4a6cc5459d4069
SHA512
a80810e8a16a9d14939e4907526b22c1de90ca78c6857affa6d81243466359a9170e75bfe879606e8a9fa7fe902f995521ecf14e8a38b0ecf9f7036d0c69ed82
SSDEEP
768:zjtrstPhvPBvXFrgM0mryT5KitnsBcp9kEsDTW65iCrihPUxriB0e1ltcYnpGl++:iPVNlY9Ki8czl05BihIq0ermMpza
Checks for missing Authenticode signature.
resource |
---|
d41ab78ff7ca755acd6d872dbbab290b |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
RestartDialog
_strnicmp
ILCloneFirst
DoEnvironmentSubstA
toupper
ImmGetOpenStatus
atol
CtfImmIsCiceroEnabled
ImmNotifyIME
qsort
ImmSetActiveContextConsoleIME
RealShellExecuteA
strncat
Activate_RunDLL
wcscat
iswlower
ILIsParent
isspace
ImmGenerateMessage
OpenThread
TryEnterCriticalSection
HeapReAlloc
HeapAlloc
ExitProcess
HeapSetInformation
SetThreadIdealProcessor
GetEnvironmentStringsA
VirtualQuery
CopyFileExA
WaitForMultipleObjects
UnmapViewOfFile
SleepEx
CreateFileA
LeaveCriticalSection
GetThreadTimes
ReadFile
GetFileAttributesA
HeapCreate
FreeEnvironmentStringsA
CreateEventA
SetThreadLocale
CreateFileMappingA
IsProcessorFeaturePresent
SetFilePointer
HeapFree
InitializeCriticalSection
MapViewOfFileEx
MapViewOfFile
EnterCriticalSection
ExpandEnvironmentStringsA
HeapDestroy
CreateProcessNotify
bthuoice
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ