OnProcessAttach
Test
_cgo_dummy_export
Overview
overview
10Static
static
3xshell软...cx.lnk
windows7-x64
3xshell软...cx.lnk
windows10-2004-x64
10xshell软...cs.vbs
windows7-x64
10xshell软...cs.vbs
windows10-2004-x64
10xshell软...mc.dll
windows7-x64
10xshell软...mc.dll
windows10-2004-x64
10xshell软....xlsx
windows7-x64
1xshell软....xlsx
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
xshell软件排查结果反馈/xshell软件排查结果反馈.docx.lnk
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
xshell软件排查结果反馈/xshell软件排查结果反馈.docx.lnk
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
xshell软件排查结果反馈/其他材料/.__MACOSX__/.__MACOS__/._MACOS_/cs.vbs
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
xshell软件排查结果反馈/其他材料/.__MACOSX__/.__MACOS__/._MACOS_/cs.vbs
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
xshell软件排查结果反馈/其他材料/.__MACOSX__/.__MACOS__/._MACOS_/mc.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
xshell软件排查结果反馈/其他材料/.__MACOSX__/.__MACOS__/._MACOS_/mc.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
xshell软件排查结果反馈/其他材料/附件-xshell软件排查结果反馈表.xlsx
Resource
win7-20240319-en
Behavioral task
behavioral8
Sample
xshell软件排查结果反馈/其他材料/附件-xshell软件排查结果反馈表.xlsx
Resource
win10v2004-20240226-en
Target
8de600a88650d22bad284c4c8a2ee009795117d3389248f4104420dce11b9a0b
Size
1.4MB
MD5
4bdc46c58367ed5abb02d667be3fc88f
SHA1
3a3a901f711f6b00ea1ef6a43691c96045571a8b
SHA256
8de600a88650d22bad284c4c8a2ee009795117d3389248f4104420dce11b9a0b
SHA512
4a289038be4879a7514dc4cdceb4f379c62d1afbc19a121038cbd168d69d5612243c709b15459573044a2790406f12c945a63d721fccdf5e3c04aa22093b832f
SSDEEP
24576:RvcNkfnDVfcgBDYGNIImc9+ZTwpnBDxzxSTpPCCbyvOX8b6Kei2cV8:VekfnD5cgBE6WOBDxzxmMCbeb6jiPu
Checks for missing Authenticode signature.
Processes:
resource |
---|
unpack001/xshell软件排查结果反馈/其他材料/.__MACOSX__/.__MACOS__/._MACOS_/mc.dll |
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
AddVectoredExceptionHandler
CloseHandle
CreateEventA
CreateFileA
CreateIoCompletionPort
CreateThread
CreateWaitableTimerExW
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
ExitProcess
FreeEnvironmentStringsW
GetConsoleMode
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStringsW
GetLastError
GetProcAddress
GetProcessAffinityMask
GetQueuedCompletionStatusEx
GetStdHandle
GetSystemDirectoryA
GetSystemInfo
GetSystemTimeAsFileTime
GetThreadContext
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
PostQueuedCompletionStatus
QueryPerformanceCounter
ResumeThread
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetConsoleCtrlHandler
SetErrorMode
SetEvent
SetProcessPriorityBoost
SetThreadContext
SetUnhandledExceptionFilter
SetWaitableTimer
Sleep
SuspendThread
SwitchToThread
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WriteConsoleW
WriteFile
__iob_func
_amsg_exit
_beginthread
_errno
_initterm
_lock
_unlock
abort
calloc
fprintf
free
fwrite
malloc
realloc
signal
strlen
strncmp
vfprintf
OnProcessAttach
Test
_cgo_dummy_export
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ