DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
e02fb3c4fa798e86b0bf2bfd779f7b3b.dll
Resource
win7-20240220-en
Target
e02fb3c4fa798e86b0bf2bfd779f7b3b
Size
64KB
MD5
e02fb3c4fa798e86b0bf2bfd779f7b3b
SHA1
31defec944af2163e8c1e3207cc102a0b83e418f
SHA256
12633813420094686154a4abba77a10a6955fbe00f3ad1f0753db8ef8baea4f3
SHA512
531c960bc970d3356aaf0970439392b1c8712cba7b9d8576b612b3b6618aa7b507b8eacf4e66e2ad354c87e8c1aeceda2d9181f6ef3be606886cbf494d614c7e
SSDEEP
768:LiNhh52yjkrQPuD18cSBvFz58nKyKCKh6iM9iTZr/z9OP67evDv+R3w11Ro3sT:LCaQrpxJ5XyLKhBB9xeD+pw3RU
Checks for missing Authenticode signature.
resource |
---|
e02fb3c4fa798e86b0bf2bfd779f7b3b |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
SetFileAttributesA
FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
GetSystemDirectoryA
GetCurrentProcessId
Process32Next
Process32First
Sleep
DisableThreadLibraryCalls
MoveFileA
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
CreateDirectoryA
GetCommandLineW
RemoveDirectoryA
CreateThread
WritePrivateProfileStringA
LocalFree
EnterCriticalSection
LeaveCriticalSection
DeleteFileA
GetModuleFileNameA
lstrlenA
MultiByteToWideChar
lstrlenW
WideCharToMultiByte
CloseHandle
GetProcAddress
ExitProcess
FreeLibrary
LoadLibraryA
InitializeCriticalSection
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegEnumKeyExA
RegDeleteKeyA
RegCloseKey
RegOpenKeyExA
RegQueryInfoKeyA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoInitialize
CoUninitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoCreateInstance
SysStringLen
LoadRegTypeLi
VariantClear
SysAllocString
SysFreeString
??2@YAPAXI@Z
_stricmp
_strlwr
_adjust_fdiv
malloc
_initterm
free
_wcslwr
wcsstr
_access
_purecall
memcpy
strncmp
strncpy
strcmp
strrchr
strstr
atoi
strchr
??3@YAXPAX@Z
strlen
memset
strcat
strcpy
sprintf
memcmp
_strupr
fclose
fread
ftell
fseek
fopen
SHDeleteValueA
SHDeleteKeyA
SHSetValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ