AddIgnorePid
AddPidToMonitor
AddProtectObject
DisableNetworkMon
DriverInject
EnableNetworkMon
GetFileInfo
OpenDirver
Release
RemoveProtectObject
SetInjectDllPath
StartFilterCommPort
StartMonitor
StopFilterCommPort
StopMonitor
Static task
static1
Behavioral task
behavioral1
Sample
59de264a865f19a8171f04f4fb60404f5da6a3d4cda52447334a54f83bfebe95.dll
Resource
win7-20240705-en
Target
59de264a865f19a8171f04f4fb60404f5da6a3d4cda52447334a54f83bfebe95
Size
512KB
MD5
989c88bc118a42f2e5a6e20a5bac3e03
SHA1
c056588dcd457887daa21972d6f125eab4304c9d
SHA256
59de264a865f19a8171f04f4fb60404f5da6a3d4cda52447334a54f83bfebe95
SHA512
2c8c9851b66ead56bf21a3ace9efa4da80045efb1687c96e87f65dc315239bbeae365c7655bd91ffbeabce4509becfa102ceddd5f89b7c9eec9057bf40d689a6
SSDEEP
12288:wN0hCMFKz/L7ROhMqcY133L1YkCKipaq1BYbJllBjvrEH7s:wNSFKz/L7Rvu6kmaaKzrEH7s
Checks for missing Authenticode signature.
resource |
---|
59de264a865f19a8171f04f4fb60404f5da6a3d4cda52447334a54f83bfebe95 |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
InitializeCriticalSection
WaitForSingleObject
DeleteCriticalSection
MultiByteToWideChar
EnterCriticalSection
LeaveCriticalSection
Sleep
SetEndOfFile
WriteConsoleW
GlobalFree
GlobalAlloc
FileTimeToSystemTime
lstrcmpA
GetFileAttributesW
LocalAlloc
SetFilePointer
OutputDebugStringA
GetFileSizeEx
LocalLock
ReadFile
QueryDosDeviceW
GetCurrentProcess
DeviceIoControl
LocalFree
FormatMessageW
FileTimeToLocalFileTime
SetStdHandle
HeapReAlloc
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
CreateFileW
WaitForMultipleObjects
CreateThread
CreateIoCompletionPort
LoadLibraryW
GetProcAddress
CloseHandle
GetLastError
GetQueuedCompletionStatus
HeapSize
GetCurrentThreadId
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
GetStringTypeW
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSectionEx
TryEnterCriticalSection
WideCharToMultiByte
EncodePointer
DecodePointer
LCMapStringEx
GetLocaleInfoEx
CompareStringEx
GetCPInfo
RtlUnwind
RaiseException
InterlockedFlushSList
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
GetStdHandle
GetFileType
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
GetTimeZoneInformation
ReadConsoleW
FindClose
wsprintfW
GetUserNameW
LookupAccountNameW
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
GetSecurityInfo
LookupAccountSidW
ConvertSidToStringSidW
FilterGetMessage
FilterConnectCommunicationPort
WinVerifyTrust
WTHelperProvDataFromStateData
CryptCATAdminAcquireContext
CryptCATCatalogInfoFromContext
CryptCATAdminReleaseContext
CryptCATAdminReleaseCatalogContext
WTHelperGetProvSignerFromChain
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminEnumCatalogFromHash
CryptDecodeObject
CryptMsgClose
CertFreeCertificateContext
CryptQueryObject
CertCloseStore
CryptMsgGetParam
CertFindCertificateInStore
CertGetNameStringW
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
AddIgnorePid
AddPidToMonitor
AddProtectObject
DisableNetworkMon
DriverInject
EnableNetworkMon
GetFileInfo
OpenDirver
Release
RemoveProtectObject
SetInjectDllPath
StartFilterCommPort
StartMonitor
StopFilterCommPort
StopMonitor
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ