LpkDllInitialize
LpkDrawTextEx
LpkEditControl
LpkExtTextOut
LpkGetCharacterPlacement
LpkGetTextExtentExPoint
LpkInitialize
LpkPSMTextOut
LpkTabbedTextOut
LpkUseGDIWidthCache
ftsWordBreak
Static task
static1
Behavioral task
behavioral1
Sample
47755b28cf9c8b5e3e1050d1d6e93147d22e93fbb96f778f79eb84477d8ba5cf.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
47755b28cf9c8b5e3e1050d1d6e93147d22e93fbb96f778f79eb84477d8ba5cf.dll
Resource
win10v2004-20240412-en
Target
47755b28cf9c8b5e3e1050d1d6e93147d22e93fbb96f778f79eb84477d8ba5cf
Size
72KB
MD5
42a1d4cf2199a55ea4eb1cea98c07d3b
SHA1
7fee58dda6c2052b09c021006e54f51c5dfe7590
SHA256
47755b28cf9c8b5e3e1050d1d6e93147d22e93fbb96f778f79eb84477d8ba5cf
SHA512
c130526947d068740303af36aee183775a9e3c8e4512612e1aaf22968d4d8e6800a173aa30ed6afaab151fe1f40e30d36a4309c079f23f8d585126c9113512a5
SSDEEP
1536:smHa9iexVfevB6ojyHDmNC62YJP5Bql6D:sp9/jf6BjyHDRpYJRc6
resource | yara_rule |
---|---|
sample | INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA |
Checks for missing Authenticode signature.
resource |
---|
47755b28cf9c8b5e3e1050d1d6e93147d22e93fbb96f778f79eb84477d8ba5cf |
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
ExitProcess
GetProcAddress
RtlMoveMemory
LoadLibraryW
lstrcatW
GetSystemDirectoryW
FreeLibrary
lstrcpynA
LockResource
LoadResource
SizeofResource
FindResourceW
CreateProcessW
RtlZeroMemory
CloseHandle
WriteFile
CreateFileW
GetTempFileNameW
GetTempPathW
GetLastError
CreateMutexA
lstrcmpiW
GetModuleFileNameW
GetExitCodeProcess
TerminateProcess
WaitForSingleObject
GetCurrentThreadId
GetFileAttributesW
lstrcpyW
GetTickCount
GetLogicalDrives
FindNextFileW
SetFileAttributesW
CopyFileW
FindClose
FindFirstFileW
WaitForMultipleObjects
TerminateThread
ResumeThread
SetThreadPriority
CreateThread
SetEvent
CreateEventW
DisableThreadLibraryCalls
wsprintfW
ord64
ord92
SHRegGetValueW
PathFindExtensionW
PathFindFileNameW
PathAppendW
PathRemoveFileSpecW
StrStrIW
LpkDllInitialize
LpkDrawTextEx
LpkEditControl
LpkExtTextOut
LpkGetCharacterPlacement
LpkGetTextExtentExPoint
LpkInitialize
LpkPSMTextOut
LpkTabbedTextOut
LpkUseGDIWidthCache
ftsWordBreak
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ