api-ms-win-downlevel-kernel32-l2-1-0.pdb
Static task
static1
Behavioral task
behavioral1
Sample
api-ms-win-downlevel-kernel32-l2-1-0.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
api-ms-win-downlevel-kernel32-l2-1-0.dll
Resource
win10v2004-20240508-en
General
-
Target
api-ms-win-downlevel-kernel32-l2-1-0.dll
-
Size
5KB
-
MD5
3fac897542488643337a6669b73384f8
-
SHA1
78d46a382f204830b317713919155b57ff557e4d
-
SHA256
595e9e5d957d2bf43037f3c509dd08720c1ec85bb11577505ae27f2e64e54459
-
SHA512
4faf847c51a5a22f0f5a13243f1d117de79d8eb074972bf31e9d1511b30e7c4931dcb20edd735e346ba4d5f2561a152e527ed92bfd8bb9cc652deb5009c2e1e8
-
SSDEEP
96:LhIb8rQRb9iRHkRLJF19Ax4O6REW4UohWw:FIb8rCbqHCJFY4bSW4UohW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource api-ms-win-downlevel-kernel32-l2-1-0.dll
Files
-
api-ms-win-downlevel-kernel32-l2-1-0.dll.dll windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Exports
Exports
AddAtomA
AddAtomW
BackupRead
BackupWrite
BindIoCompletionCallback
ConvertFiberToThread
ConvertThreadToFiber
CopyFileA
CopyFileW
CreateFiber
CreateFileMappingA
CreateFileTransactedW
CreateMailslotA
CreateNamedPipeA
CreateSemaphoreW
DeleteAtom
DeleteFiber
DnsHostnameToComputerNameW
DosDateTimeToFileTime
FatalAppExitA
FatalAppExitW
FileTimeToDosDateTime
FindAtomA
FindAtomW
FindResourceA
FindResourceExA
FindResourceW
GetActiveProcessorCount
GetAtomNameA
GetAtomNameW
GetComputerNameA
GetComputerNameW
GetConsoleWindow
GetDurationFormatEx
GetFirmwareEnvironmentVariableW
GetMaximumProcessorGroupCount
GetNamedPipeClientProcessId
GetNamedPipeServerProcessId
GetPrivateProfileIntA
GetPrivateProfileIntW
GetPrivateProfileSectionW
GetPrivateProfileStringA
GetPrivateProfileStringW
GetProcessAffinityMask
GetProcessIoCounters
GetProfileIntA
GetProfileIntW
GetProfileSectionA
GetProfileSectionW
GetProfileStringA
GetProfileStringW
GetShortPathNameA
GetStartupInfoA
GetStringTypeExA
GetSystemPowerStatus
GetSystemWow64DirectoryA
GetSystemWow64DirectoryW
GetTapeParameters
GetTempPathA
GetThreadSelectorEntry
GlobalAddAtomA
GlobalAddAtomW
GlobalAlloc
GlobalDeleteAtom
GlobalFindAtomA
GlobalFindAtomW
GlobalFlags
GlobalFree
GlobalGetAtomNameA
GlobalGetAtomNameW
GlobalHandle
GlobalLock
GlobalMemoryStatus
GlobalReAlloc
GlobalSize
GlobalUnlock
InitAtomTable
LoadLibraryA
LoadLibraryW
LocalAlloc
LocalFlags
LocalFree
LocalLock
LocalReAlloc
LocalSize
LocalUnlock
MoveFileA
MoveFileExA
MoveFileW
MulDiv
OpenFile
PulseEvent
RaiseFailFastException
RegisterWaitForSingleObject
SetConsoleTitleA
SetFileCompletionNotificationModes
SetFirmwareEnvironmentVariableW
SetHandleCount
SetMailslotInfo
SetProcessAffinityMask
SetThreadAffinityMask
SetThreadIdealProcessor
SetVolumeLabelW
SwitchToFiber
UnregisterWait
WTSGetActiveConsoleSessionId
WaitForMultipleObjects
WritePrivateProfileSectionA
WritePrivateProfileSectionW
WritePrivateProfileStringA
WritePrivateProfileStringW
lstrcatW
lstrcmpA
lstrcmpW
lstrcmpiA
lstrcmpiW
lstrcpyW
lstrcpynA
lstrcpynW
lstrlenA
lstrlenW
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 1008B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ