IsInBlacklist
IsInTAccCtrllist
IsInWhitelist
RegisterNetSecurityProc
SecurityProxyStart
SetEnableNetSecurity
SetGWMode
StartUploadCtrl
TAccCtrlStart
TAccCtrlStop
TMailHookStart
TMailHookStop
TSafeGWStart
TSafeGWStop
UnRegisterNetSecurityProc
Static task
static1
Behavioral task
behavioral1
Sample
b34f957963f020cd8ba8eb5e9c3754de3e277a6d8648671d81bf1996133d51e2.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
b34f957963f020cd8ba8eb5e9c3754de3e277a6d8648671d81bf1996133d51e2.dll
Resource
win10v2004-20240611-en
Target
b34f957963f020cd8ba8eb5e9c3754de3e277a6d8648671d81bf1996133d51e2
Size
820KB
MD5
250ff1a5bfa234d04eb5b56625cce701
SHA1
99905e16b7b4091714341c56fca36dbb19204aa4
SHA256
b34f957963f020cd8ba8eb5e9c3754de3e277a6d8648671d81bf1996133d51e2
SHA512
8cdc7cc399434edb2780b0e10057f628ae70c0ef0278a06d24c62251a39ef0b65d903e8271e558572ebb0ca040b5ab92bbc6bf3eb02b2f463e7c9f1e05ed817a
SSDEEP
12288:xFcAyis4mAywSYFW+oS+zQotTIhIWvsRlnvCvNA2h0M4C:xdyis4mAysRotTI7EDnJ2h0NC
Checks for missing Authenticode signature.
resource |
---|
b34f957963f020cd8ba8eb5e9c3754de3e277a6d8648671d81bf1996133d51e2 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
RegCloseKey
RegQueryValueExW
RegCreateKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
LookupAccountSidW
GetTokenInformation
GetUserNameW
RegOpenKeyW
RegSetValueExW
SetFileSecurityW
RegOpenKeyExW
RegCreateKeyExW
RegQueryValueExA
RegSetValueExA
RegEnumKeyW
RegQueryInfoKeyW
RegEnumValueW
RegDeleteKeyW
RegDeleteValueW
RegSetKeySecurity
InitializeSecurityDescriptor
GetLengthSid
InitializeAcl
AddAccessAllowedAce
GetAce
SetSecurityDescriptorDacl
LookupAccountNameW
OpenSCManagerW
OpenServiceW
CloseServiceHandle
QueryServiceStatus
RegOpenKeyA
RegCreateKeyExA
RegCreateKeyA
RegConnectRegistryW
SetThreadDesktop
GetThreadDesktop
OpenDesktopW
OpenInputDesktop
GetUserObjectInformationW
GetProcessWindowStation
CloseWindowStation
SetProcessWindowStation
GetSystemMetrics
MsgWaitForMultipleObjects
OpenWindowStationW
MessageBoxW
EnumDesktopWindows
GetWindowThreadProcessId
GetWindowLongW
GetParent
IsWindowVisible
EnumWindows
GetWindowTextA
GetWindowTextW
CloseDesktop
getsockname
recvfrom
__WSAFDIsSet
select
closesocket
inet_addr
htons
socket
WSAGetLastError
ntohl
inet_ntoa
gethostbyname
sendto
getpeername
htonl
send
getsockopt
WSASetLastError
WSAIoctl
WSAStartup
ntohs
GetDriveTypeW
GetLogicalDrives
QueryDosDeviceW
QueryDosDeviceA
GetVolumeInformationW
SetVolumeLabelW
GetDiskFreeSpaceExW
DefineDosDeviceW
GetDriveTypeA
DeviceIoControl
VirtualProtect
GetWindowsDirectoryA
CreateFileMappingA
BeginUpdateResourceW
UpdateResourceW
FreeLibrary
GetProcAddress
LoadLibraryW
MultiByteToWideChar
GetLastError
Sleep
GetCurrentThreadId
OutputDebugStringW
GetTickCount
GetCurrentProcessId
WaitForSingleObject
CloseHandle
OpenMutexW
ReleaseMutex
GetModuleHandleW
GetModuleFileNameW
SetLastError
GetLongPathNameW
OpenEventW
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetSystemDirectoryW
GetWindowsDirectoryW
WideCharToMultiByte
GetFileInformationByHandle
CreateFileA
GetModuleHandleA
CreateThread
GetCurrentProcess
OpenProcess
LocalFree
FindClose
FindNextFileA
FindFirstFileA
FindNextFileW
FindFirstFileW
GetSystemInfo
DeleteFileW
RemoveDirectoryW
lstrcmpW
SetFileAttributesW
GetFileAttributesW
CopyFileW
MoveFileW
ReadFile
CreateFileW
CreateDirectoryW
GetProfileStringW
InterlockedIncrement
InterlockedDecrement
lstrlenA
FormatMessageA
LoadResource
FindResourceExW
GetACP
lstrlenW
FormatMessageW
GetVersionExW
DeleteCriticalSection
SleepEx
InterlockedExchange
CreateSemaphoreW
ReleaseSemaphore
CreateMutexW
CreateEventW
SetEvent
PulseEvent
ResetEvent
WaitForMultipleObjects
TerminateThread
ResumeThread
SetThreadPriority
SuspendThread
GetExitCodeThread
RtlUnwind
GetCommandLineA
GetVersion
RaiseException
HeapAlloc
HeapFree
ExitProcess
TerminateProcess
HeapReAlloc
HeapSize
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
GetCurrentThread
FatalAppExitA
CompareStringA
CompareStringW
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
WriteFile
SetUnhandledExceptionFilter
VirtualAlloc
IsBadWritePtr
IsBadReadPtr
IsBadCodePtr
UnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
GetCPInfo
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
SetFilePointer
GetOEMCP
LoadLibraryA
SetConsoleCtrlHandler
SetStdHandle
GetTimeZoneInformation
GetLocaleInfoW
FlushFileBuffers
SetEnvironmentVariableA
GetLocalTime
FreeConsole
WriteConsoleW
AllocConsole
ExpandEnvironmentStringsA
GetSystemDirectoryA
ExpandEnvironmentStringsW
GetCurrentDirectoryW
GetCurrentDirectoryA
GetTempPathA
GetTempPathW
GetEnvironmentVariableW
SetFileAttributesA
GetFileAttributesA
DeleteFileA
MoveFileA
CreateDirectoryA
CopyFileA
RemoveDirectoryA
MoveFileExA
MoveFileExW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetFileSize
OpenFileMappingW
lstrcmpA
LocalAlloc
SetPriorityClass
GetPriorityClass
GetThreadPriority
ReadProcessMemory
CreateProcessA
InterlockedCompareExchange
InterlockedExchangeAdd
CreateProcessW
VirtualQueryEx
FreeResource
LoadLibraryExW
VirtualQuery
LockResource
SizeofResource
EnumResourceNamesW
EnumResourceTypesW
EnumResourceLanguagesW
EndUpdateResourceW
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
CoInitializeEx
CoInitialize
IsInBlacklist
IsInTAccCtrllist
IsInWhitelist
RegisterNetSecurityProc
SecurityProxyStart
SetEnableNetSecurity
SetGWMode
StartUploadCtrl
TAccCtrlStart
TAccCtrlStop
TMailHookStart
TMailHookStop
TSafeGWStart
TSafeGWStop
UnRegisterNetSecurityProc
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ