M0
M1
M10
M11
M12
M13
M14
M15
M2
M3
M4
M5
M6
M7
M8
M9
M_S0
M_S1
MaiDMFunc
MaiSfDummyEp
MmkeSureDirectoryPathExists
_MmmAssociateContext@8
Static task
static1
Behavioral task
behavioral1
Sample
1b196e72da1fa74ac578a68f8b0bca89c67bee96e471d86febc5a84f01964a1b.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1b196e72da1fa74ac578a68f8b0bca89c67bee96e471d86febc5a84f01964a1b.dll
Resource
win10v2004-20231215-en
Target
1b196e72da1fa74ac578a68f8b0bca89c67bee96e471d86febc5a84f01964a1b
Size
703KB
MD5
0252eab60b5578a1b9cec658dea926eb
SHA1
40023e9283f285989f554dd935edbb9ab240be68
SHA256
1b196e72da1fa74ac578a68f8b0bca89c67bee96e471d86febc5a84f01964a1b
SHA512
8d6fdf3f6ff8876cf6512b5d6a760a891607b5409b528721744a3ab5c54ff6d247127db099c7ce42b1527d9f8e80e1f1059808c4b64140a17f8cb010ca64bcc2
SSDEEP
6144:q9v/ZgzOK+E6rZ4qr+/Iml0eTn5APeFZ6lxz0hDlWHpOCYR:6hwOK+FZH+/I/cn5Ue3MxDXe
Checks for missing Authenticode signature.
resource |
---|
1b196e72da1fa74ac578a68f8b0bca89c67bee96e471d86febc5a84f01964a1b |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
htonl
WriteProcessMemory
GetModuleFileNameW
GetProcAddress
LoadLibraryA
LoadLibraryW
K32EnumProcessModules
K32GetModuleFileNameExW
VirtualProtect
ExitProcess
CreateFileA
CreateFileW
CreateProcessW
GetModuleHandleW
IsDebuggerPresent
CloseHandle
SetUnhandledExceptionFilter
Sleep
GetCurrentProcessId
GetCurrentThreadId
OpenThread
GetThreadContext
SetThreadContext
VirtualAlloc
OpenFileMappingW
ReadProcessMemory
UnmapViewOfFile
GetModuleHandleA
SetProcessDEPPolicy
GetPrivateProfileStringW
CreateToolhelp32Snapshot
Thread32First
Thread32Next
CreateProcessA
ReadFile
ConnectNamedPipe
DisconnectNamedPipe
CreateNamedPipeA
GetTempPathW
WaitForSingleObject
CreatePipe
SetHandleInformation
RemoveDirectoryW
FindNextFileW
FindFirstFileW
FindClose
CreateDirectoryW
VirtualProtectEx
VirtualAllocEx
ResumeThread
SuspendThread
HeapCreate
InitializeCriticalSection
MoveFileExW
MapViewOfFile
GetLastError
SetFilePointer
SetEndOfFile
GetFileSize
GetFileAttributesW
IsProcessorFeaturePresent
RtlUnwind
EnterCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
GetCommandLineA
HeapAlloc
RaiseException
HeapDestroy
HeapFree
UnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetTickCount
CreateSemaphoreW
GetCurrentThread
DeleteCriticalSection
FatalAppExitA
GetModuleHandleExW
AreFileApisANSI
MultiByteToWideChar
WideCharToMultiByte
FlushFileBuffers
WriteFile
GetConsoleCP
GetConsoleMode
GetStdHandle
GetFileType
GetProcessHeap
GetModuleFileNameA
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
HeapReAlloc
SetConsoleCtrlHandler
FreeLibrary
LoadLibraryExW
SetStdHandle
SetFilePointerEx
WriteConsoleW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ReadConsoleW
OutputDebugStringW
GetStringTypeW
HeapSize
VirtualFree
CreateThread
DeleteFileW
RegisterClassExA
MessageBoxA
RegisterClassA
wsprintfW
MessageBoxW
LoadStringA
CreateWindowExA
EnumFontFamiliesExW
RegOpenKeyExW
RegOpenKeyExA
MakeSureDirectoryPathExists
ImmAssociateContext
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
M0
M1
M10
M11
M12
M13
M14
M15
M2
M3
M4
M5
M6
M7
M8
M9
M_S0
M_S1
MaiDMFunc
MaiSfDummyEp
MmkeSureDirectoryPathExists
_MmmAssociateContext@8
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ