?RdvServiceMain@@YAXPEAX0K0K@Z
DllRegisterServer
DllUnregisterServer
VssServiceMain
Static task
static1
Behavioral task
behavioral1
Sample
1a80279b1f972aedb2b1010991f9c5ab7e7526deb2be69e70b88e820fb657e8b.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1a80279b1f972aedb2b1010991f9c5ab7e7526deb2be69e70b88e820fb657e8b.dll
Resource
win10v2004-20240426-en
Target
1a80279b1f972aedb2b1010991f9c5ab7e7526deb2be69e70b88e820fb657e8b
Size
805KB
MD5
24a3d00823ecc6a53769a767775c7adb
SHA1
5e4702133bf0751b8b205c5282afd9bf86e09605
SHA256
1a80279b1f972aedb2b1010991f9c5ab7e7526deb2be69e70b88e820fb657e8b
SHA512
25ca8085f6f9cf5ec8b3d87af62381bfd9ecd209a634a95b3d4f9e63c6e8f114411746c8019ae2d591233b4fff95d61b9fb70ba4c81fb4c9be52b855d7f1828b
SSDEEP
24576:+k1Op2gF+QQdkl3NUzlRaw70jFtAGpSu4Tkmhexgr:d1K4I3NyyvdST1hex6
Checks for missing Authenticode signature.
Processes:
resource |
---|
1a80279b1f972aedb2b1010991f9c5ab7e7526deb2be69e70b88e820fb657e8b |
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
CertFreeCertificateContext
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
FileTimeToSystemTime
GetFileInformationByHandle
GetFileSize
SetFilePointer
ReadFile
CreateFileW
CreateFileMappingW
MapViewOfFile
CloseHandle
WriteFile
UnmapViewOfFile
GetLocalTime
SystemTimeToFileTime
WideCharToMultiByte
GetTickCount
VirtualProtect
LoadLibraryW
EnterCriticalSection
InitializeCriticalSectionEx
GetLastError
DeleteCriticalSection
FormatMessageA
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
InitializeCriticalSection
RtlCaptureContext
LeaveCriticalSection
GetProcAddress
GetModuleHandleW
CreateEventW
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
OutputDebugStringW
IsDebuggerPresent
InitializeSListHead
CryptAcquireContextA
CryptReleaseContext
CryptGenRandom
_Mtx_unlock
_Cnd_init
_Cnd_destroy
_Cnd_init_in_situ
_Cnd_destroy_in_situ
_Cnd_wait
_Cnd_timedwait
_Cnd_signal
_Cnd_do_broadcast_at_thread_exit
?_Throw_C_error@std@@YAXH@Z
?_Throw_Cpp_error@std@@YAXH@Z
?uncaught_exception@std@@YA_NXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_J@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_K@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Random_device@std@@YAIXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?_BADOFF@std@@3_JB
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
_Tolower
_Toupper
??0_Locinfo@std@@QEAA@PEBD@Z
??1_Locinfo@std@@QEAA@XZ
?_Getctype@_Locinfo@std@@QEBA?AU_Ctypevec@@XZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
??Bid@locale@std@@QEAA_KXZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0ctype_base@std@@QEAA@_K@Z
??1ctype_base@std@@UEAA@XZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z
_Query_perf_counter
_Query_perf_frequency
_Thrd_detach
_Thrd_sleep
_Mtx_current_owns
_Mtx_lock
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
_Thrd_start
_Xtime_get_ticks
_Thrd_join
_Thrd_id
_Mtx_init
_Mtx_destroy
_Mtx_init_in_situ
_Mtx_destroy_in_situ
freeaddrinfo
__WSAFDIsSet
select
WSAStartup
WSACleanup
closesocket
recv
send
WSAGetLastError
connect
ioctlsocket
setsockopt
socket
getaddrinfo
__std_type_info_destroy_list
__std_exception_destroy
__std_exception_copy
memcmp
strchr
__vcrt_InitializeCriticalSectionEx
__CxxFrameHandler3
__std_terminate
memmove
memset
__C_specific_handler
strstr
wcsrchr
_purecall
memcpy
_CxxThrowException
memchr
_invalid_parameter_noinfo_noreturn
terminate
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_errno
strerror
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
calloc
malloc
free
_callnewh
isspace
strncpy
wcsncpy_s
wcsncat_s
strncpy_s
_wcsicmp
isalnum
tolower
strncat_s
isalpha
strlen
_wchmod
_gmtime64_s
_localtime64_s
_time64
fclose
__stdio_common_vsnprintf_s
fseek
__stdio_common_vsnwprintf_s
fread
fopen
ftell
__stdio_common_vsscanf
srand
rand
atoi
pow
?RdvServiceMain@@YAXPEAX0K0K@Z
DllRegisterServer
DllUnregisterServer
VssServiceMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ