Target
bvJEkVYwQT662210377463324171.xml
Size
59KB
MD5
ec637273bc8dba95b0b207ff3146ed9d
SHA1
5cba564fd731f6de8ac3d610d22c98b603dfee54
SHA256
ad697691ab8cdb3437cd74107a44d943e95918971984449cee213e5b6db06356
SHA512
58b0c5d075768daa251ea6481462a608e2f2999e6f76743940ba82e850f4e423e84d8eaac622f80de4f4f1f2244f938923e54abb17c1d522832bf39d02a550cf
SSDEEP
1536:TGb9dtrcRd+iRTOhquOMlpJZ9ZYMFwLa+rxwe:YtoRHRTOMuO6JRYGaa+rxwe
| resource | yara_rule |
|---|---|
| sample | qarallax_dll |
Checks for missing Authenticode signature.
| resource |
|---|
| bvJEkVYwQT662210377463324171.xml |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
CreateFileW
LocalFree
GetModuleHandleA
SetStdHandle
WriteConsoleW
CloseHandle
GetProcAddress
GetLastError
FormatMessageW
HeapFree
HeapAlloc
GetCurrentThreadId
FlsSetValue
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
HeapSetInformation
GetVersion
HeapCreate
HeapDestroy
GetModuleHandleW
ExitProcess
DecodePointer
WriteFile
GetStdHandle
GetModuleFileNameW
EncodePointer
RtlUnwindEx
EnterCriticalSection
LeaveCriticalSection
RaiseException
RtlPcToFileHeader
FlsGetValue
FlsFree
SetLastError
FlsAlloc
Sleep
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LoadLibraryW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
HeapReAlloc
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LCMapStringW
MultiByteToWideChar
GetStringTypeW
SetFilePointer
GetForegroundWindow
GetWindowTextW
GetWindowTextLengthW
CryptReleaseContext
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDecrypt
CryptDestroyKey
CryptDeriveKey
ShellExecuteW
SHGetSpecialFolderPathW
CryptUnprotectData
CryptProtectData
Java_server_windows_dll_WinMethod_CryptDecrypt
Java_server_windows_dll_WinMethod_cryptProtectData
Java_server_windows_dll_WinMethod_cryptUnprotectData
Java_server_windows_dll_WinMethod_disableWow64
Java_server_windows_dll_WinMethod_getSpecialFolderPath
Java_server_windows_dll_WinMethod_getWindowTitle
Java_server_windows_dll_WinMethod_shellExecute
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ