aCmHmjrptS
SetPath
Behavioral task
behavioral1
Sample
8640824dd436af0e73c51a89aa86987f22fb76f60be94f61f3ae3affe5f0927e.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
8640824dd436af0e73c51a89aa86987f22fb76f60be94f61f3ae3affe5f0927e.dll
Resource
win10v2004-20240508-en
Target
8640824dd436af0e73c51a89aa86987f22fb76f60be94f61f3ae3affe5f0927e
Size
804KB
MD5
84cfa5bac0faa823d116644de18a20e3
SHA1
80dae96c422ebad401d870ea1720b4a4622bf7cc
SHA256
8640824dd436af0e73c51a89aa86987f22fb76f60be94f61f3ae3affe5f0927e
SHA512
427b83f923a3d0349714de8de70c468cc96d510d83459885a43be0eb78859d50b572d508ef9351a8ed3194bb197643c08a8c0286ed649edfcd7f4fd4b86765b0
SSDEEP
12288:cipvTLaZ+ZyRY2POCN2zPj77ejZYEc6QfBoHmuv+kfkQQkh:cipvTOZ+uPOC8H7KYEc6QfBud+ksQQ
bumblebee
1105a
142.11.222.79:443
23.254.224.200:443
103.175.16.52:443
199.195.252.30:443
resource | yara_rule |
---|---|
sample | INDICATOR_SUSPICIOUS_References_SecTools |
Checks for missing Authenticode signature.
resource |
---|
8640824dd436af0e73c51a89aa86987f22fb76f60be94f61f3ae3affe5f0927e |
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
CertGetCertificateChain
CertVerifyCertificateChainPolicy
CertFreeCertificateChain
CertFreeCertificateChainEngine
CertFreeCertificateContext
CertCreateCertificateChainEngine
InitSecurityInterfaceA
SetEvent
TerminateThread
GetCurrentProcessId
CreateEventA
SetWaitableTimer
TlsSetValue
VerifyVersionInfoA
SetLastError
EnterCriticalSection
WaitForMultipleObjects
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateEventW
FormatMessageW
TlsAlloc
QueueUserAPC
CreateWaitableTimerA
LocalFree
DeleteCriticalSection
VerSetConditionMask
WideCharToMultiByte
SleepEx
TlsGetValue
TlsFree
FormatMessageA
CreateIoCompletionPort
ReadFile
SetHandleInformation
WriteFile
TerminateProcess
CreatePipe
CreateProcessA
FileTimeToSystemTime
LoadLibraryW
GetLocalTime
GetProcAddress
SystemTimeToFileTime
GetModuleHandleW
GetCurrentProcess
Thread32Next
Thread32First
GetModuleHandleA
OpenProcess
LoadLibraryA
VirtualProtectEx
OpenThread
MultiByteToWideChar
GetModuleFileNameW
SetFilePointer
lstrlenA
CreateFileW
lstrcmpA
VirtualAlloc
HeapFree
CreateFileA
HeapReAlloc
HeapAlloc
GetFileSize
GetLastError
VirtualQuery
lstrcpyA
Wow64DisableWow64FsRedirection
ExpandEnvironmentStringsW
Wow64RevertWow64FsRedirection
GetWindowsDirectoryW
GlobalMemoryStatusEx
VerifyVersionInfoW
GetFileAttributesW
Process32NextW
Process32FirstW
GetStdHandle
RtlLookupFunctionEntry
RtlCaptureContext
WaitForSingleObjectEx
SetFilePointerEx
HeapSize
GetConsoleMode
Sleep
lstrcatA
CreateDirectoryA
GetFileAttributesA
GetModuleFileNameA
CloseHandle
CreateToolhelp32Snapshot
WaitForSingleObject
GetConsoleCP
FlushFileBuffers
SetStdHandle
ResetEvent
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
FindNextFileA
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
GetSystemTimeAsFileTime
QueryPerformanceFrequency
QueryPerformanceCounter
RaiseException
DecodePointer
EncodePointer
RtlPcToFileHeader
GetProcessHeap
FindFirstFileExA
FindClose
GetOEMCP
IsValidCodePage
OutputDebugStringW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
ExitProcess
GetACP
WriteConsoleW
GetFileType
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
FreeLibrary
RtlUnwindEx
InterlockedFlushSList
InitializeSListHead
GetCurrentThreadId
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
FindWindowW
wsprintfW
LookupPrivilegeValueA
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
GetUserNameW
SHGetSpecialFolderPathW
SHGetSpecialFolderPathA
CoCreateInstance
CoUninitialize
CoInitializeEx
CoSetProxyBlanket
CoInitializeSecurity
SafeArrayGetUBound
SafeArrayGetElement
SafeArrayGetLBound
SafeArrayUnaccessData
SafeArrayAccessData
SysFreeString
SysAllocString
VariantClear
VariantInit
WNetGetProviderNameW
GetAdaptersInfo
WSASetLastError
select
WSASend
WSASocketW
WSAGetLastError
setsockopt
getaddrinfo
ioctlsocket
freeaddrinfo
getsockopt
WSARecv
WSACleanup
connect
closesocket
WSAStartup
PathCombineW
StrCmpIW
StrChrA
StrStrIW
StrToIntA
aCmHmjrptS
SetPath
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ