API-MS-Win-Security-GroupPolicy-L1-1-0.pdb
Static task
static1
Behavioral task
behavioral1
Sample
api-ms-win-security-grouppolicy-l1-1-0.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
api-ms-win-security-grouppolicy-l1-1-0.dll
Resource
win10v2004-20240426-en
General
-
Target
api-ms-win-security-grouppolicy-l1-1-0.dll
-
Size
4KB
-
MD5
04682c1795b80bd0ca1d322cb753aaa8
-
SHA1
eadc7d18061cb9478e901a5451afd45d0a8ee58f
-
SHA256
a49be3cbdf8744fbb6009d8e2cf78c440cc3ba581b8680b41ffbe33c80de8dcb
-
SHA512
ff4906c21767c549d4da6f02818c6cab546a18249d42d3fcc1c806419d5a8cc10b9bf1b5e6802d5ffc22fda05a84fb4ce8eb13361f684e0036d2b1b0cf9fd71c
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource api-ms-win-security-grouppolicy-l1-1-0.dll
Files
-
api-ms-win-security-grouppolicy-l1-1-0.dll.dll windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Exports
Exports
AreThereVisibleLogoffScriptsInternal
AreThereVisibleShutdownScriptsInternal
EnterCriticalPolicySectionInternal
ForceSyncFgPolicyInternal
FreeGPOListInternalA
FreeGPOListInternalW
GenerateGPNotificationInternal
GetAppliedGPOListInternalA
GetAppliedGPOListInternalW
GetGPOListInternalA
GetGPOListInternalW
GetNextFgPolicyRefreshInfoInternal
GetPreviousFgPolicyRefreshInfoInternal
HasPolicyForegroundProcessingCompletedInternal
IsSyncForegroundPolicyRefresh
LeaveCriticalPolicySectionInternal
RefreshPolicyExInternal
RefreshPolicyInternal
RegisterGPNotificationInternal
RsopLoggingEnabledInternal
UnregisterGPNotificationInternal
WaitForMachinePolicyForegroundProcessingInternal
WaitForUserPolicyForegroundProcessingInternal
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 1008B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 26B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ