DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetVer
Install
Static task
static1
Behavioral task
behavioral1
Sample
e1dfed24548cfb171c80f398c30dd0b1.dll
Resource
win7-20240319-en
Target
e1dfed24548cfb171c80f398c30dd0b1
Size
60KB
MD5
e1dfed24548cfb171c80f398c30dd0b1
SHA1
256f21fefe831fa204a71032aee72f10a61d81e3
SHA256
76287d82405fb24afaddfa8613e24ce80a8b9292ae743c61e7d6b9aeab0ddb78
SHA512
c59ac1551edabb9d47826692dd6701ba537cde9e51b2d79ef37ee08ba0a3d0c776fc581cd9f21e42cb811da30d861a0d82e1cd8444f14f29ad30836b6ad05aae
SSDEEP
768:+wvnsw/C4S+PkLZm2uWAzzBuuIKlRo4DuHmvqNjiK9dEm5500ixs:Jvu4S+m/AkUo4fv01gms0ixs
Checks for missing Authenticode signature.
resource |
---|
e1dfed24548cfb171c80f398c30dd0b1 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetModuleFileNameW
FreeLibrary
MultiByteToWideChar
lstrlenA
SizeofResource
LoadResource
FindResourceW
GetLastError
LoadLibraryExW
lstrcmpiW
lstrcpynW
GetModuleHandleW
GetProcAddress
LoadLibraryW
lstrcpyW
lstrcatW
DeleteFileA
WinExec
GetBinaryTypeA
GetTickCount
GetTempPathA
WideCharToMultiByte
GetShortPathNameW
lstrlenW
InterlockedDecrement
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetLocalTime
DisableThreadLibraryCalls
GetModuleHandleA
GetModuleFileNameA
CreateThread
Sleep
GetCurrentProcess
HeapDestroy
CloseHandle
SetWindowsHookExW
CallNextHookEx
CharNextW
GetMessageW
CharLowerA
UnhookWindowsHookEx
RegOpenKeyExA
RegQueryValueExW
RegCreateKeyA
RegSetValueExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegCreateKeyExW
RegDeleteValueW
RegOpenKeyExW
RegEnumKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumValueW
RegDeleteKeyW
ShellExecuteA
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
LoadRegTypeLi
RegisterTypeLi
VariantClear
SysAllocString
SysFreeString
VarUI4FromStr
LoadTypeLi
SysStringLen
_adjust_fdiv
_stricmp
_initterm
wcscmp
wcslen
swprintf
calloc
_access
rename
fwrite
fclose
strncmp
strchr
memcmp
realloc
malloc
free
??2@YAPAXI@Z
??3@YAXPAX@Z
_purecall
memset
sprintf
memcpy
strcpy
strlen
strstr
fgets
fopen
_splitpath
strcmp
strcat
atoi
htons
inet_addr
connect
recv
send
closesocket
gethostbyname
WSAStartup
socket
Netbios
InternetReadFile
InternetOpenUrlA
InternetOpenA
InternetCloseHandle
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetVer
Install
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ