Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
4176d3a0eef3a411221bb6c61bb47110N.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4176d3a0eef3a411221bb6c61bb47110N.dll
Resource
win10v2004-20240709-en
Target
4176d3a0eef3a411221bb6c61bb47110N.exe
Size
600KB
MD5
4176d3a0eef3a411221bb6c61bb47110
SHA1
b211f6be539c675934ab481fe7c81332a93a25ac
SHA256
0953456ffae62532549ea4e13d8e012b5736a7fc78daa304498499dfd1053a39
SHA512
8f422bab3a69a3d2f36ba181a8c276c88f851d3f094a4341aad536c92a68822b9b4ac843c4638ddf05c76601f65428e146fd26e2b8112cb2fe996755e11aa48d
SSDEEP
6144:d76GgSBs60bqZ3huoHamnYpsj7TwOzmxhf62TBJDlgAhHkOOAkwpxEP3/TZmOXne:XNZxuoHaBajnY7f62T5BJlzEPrAEqwq
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
k:\5620\exe\vsa64\release\multi\standard\kb_link.pdb
CreateFileW
RemoveDirectoryW
CreateDirectoryW
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetTempPathW
GetDriveTypeW
SetFileShortNameW
GetFileInformationByHandle
SetFileTime
SetFilePointer
SetEndOfFile
DeviceIoControl
FlushFileBuffers
ReadFile
WriteFile
UnlockFileEx
LockFileEx
SetFileAttributesW
GetProcessWorkingSetSize
GetCurrentDirectoryW
GetWindowsDirectoryW
GetDriveTypeA
LocalFree
FormatMessageW
GetModuleHandleA
SetEvent
ResetEvent
WaitForSingleObject
WaitForMultipleObjects
CloseHandle
CreateEventA
GetVersion
GetCurrentThread
SetThreadPriority
GetThreadPriority
TerminateThread
GetLastError
Sleep
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
FreeLibrary
GetProcAddress
LoadLibraryA
GetLocaleInfoA
GetUserDefaultUILanguage
EncodePointer
DecodePointer
IsDebuggerPresent
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
GetCompressedFileSizeW
DeleteFileW
FindFirstFileW
FindNextFileW
MoveFileW
MoveFileExW
CreateHardLinkW
GetVolumeInformationW
FindFirstChangeNotificationW
GetVolumeNameForVolumeMountPointW
GetVolumePathNameW
CompareStringW
FindNextChangeNotification
FindCloseChangeNotification
LockResource
ExitThread
LoadResource
FindResourceExW
EnumResourceNamesW
EnumResourceLanguagesW
QueryDosDeviceA
GetSystemDefaultLangID
GetTimeZoneInformation
GetFileTime
BackupRead
BackupSeek
BackupWrite
GetFileAttributesW
GetFileAttributesExW
DuplicateHandle
OutputDebugStringW
LCMapStringW
ReleaseSemaphore
CreateSemaphoreA
TlsAlloc
TlsGetValue
TlsSetValue
GetSystemDefaultUILanguage
SetProcessWorkingSetSize
GetVersionExA
GetModuleFileNameW
FindClose
GetLogicalDrives
SetErrorMode
WriteConsoleW
GetStdHandle
TlsFree
lstrcmpiW
InitializeCriticalSectionAndSpinCount
SetLastError
GetCurrentProcess
LocalAlloc
WideCharToMultiByte
MultiByteToWideChar
ExpandEnvironmentStringsW
ord3033
ord3024
CloseEncryptedFileRaw
ReadEncryptedFileRaw
OpenEncryptedFileRawW
SetThreadToken
GetSecurityDescriptorOwner
DecryptFileW
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RevertToSelf
OpenThreadToken
ImpersonateLoggedOnUser
EncryptFileW
LookupPrivilegeValueA
GetFileSecurityW
SetFileSecurityW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetSidSubAuthorityCount
GetSidSubAuthority
GetSidIdentifierAuthority
FreeSid
AllocateAndInitializeSid
IsValidSid
AdjustTokenPrivileges
GetTokenInformation
OpenProcessToken
RegDeleteKeyW
SetSecurityInfo
RegSetValueExW
RegSetKeySecurity
RegQueryValueExW
RegQueryInfoKeyA
RegOpenKeyExW
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegCreateKeyExW
WriteEncryptedFileRaw
??1exception@std@@UEAA@XZ
strcmp
_wcstoui64
wcschr
??0exception@std@@QEAA@XZ
fputws
fflush
__iob_func
malloc
swscanf
_set_invalid_parameter_handler
_get_invalid_parameter_handler
_purecall
_CxxThrowException
__CxxFrameHandler3
memcmp
memcpy
memset
sprintf
strchr
_errno
rand
srand
_time64
_beginthreadex
wcstol
_lock
_strnicmp
_unlock
_calloc_crt
__dllonexit
__C_specific_handler
_onexit
__lconv_init
__CppXcptFilter
_amsg_exit
free
_malloc_crt
_initterm
strtoul
??_U@YAPEAX_K@Z
??_V@YAXPEAX@Z
memchr
memmove
??3@YAXPEAX@Z
??2@YAPEAX_K@Z
__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
?terminate@@YAXXZ
__crtCapturePreviousContext
__crtCaptureCurrentContext
__crtTerminateProcess
__crtUnhandledException
__crt_debugger_hook
_initterm_e
??0exception@std@@QEAA@AEBV01@@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?_BADOFF@std@@3_JB
??_7ios_base@std@@6B@
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
?_Ios_base_dtor@ios_base@std@@CAXPEAV12@@Z
?uncaught_exception@std@@YA_NXZ
?_Winerror_map@std@@YAPEBDH@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
CharUpperBuffW
TranslateMessage
DispatchMessageA
RegisterClassExA
CreateWindowExA
wsprintfW
DefWindowProcA
GetMessageA
__WSAFDIsSet
connect
select
setsockopt
shutdown
WSAGetLastError
WSARecv
WSASend
ioctlsocket
freeaddrinfo
getaddrinfo
WSACleanup
WSAStartup
socket
closesocket
ord645
ord644
ord4
ord2
SHGetDesktopFolder
SHGetFolderPathW
ord21
SHGetPathFromIDListW
SHGetMalloc
CoInitializeEx
CoUninitialize
CoInitialize
CoCreateInstance
VariantChangeType
VariantClear
VariantInit
SafeArrayUnaccessData
SafeArrayAccessData
WNetOpenEnumW
WNetCancelConnection2W
WNetAddConnection3W
WNetGetUniversalNameW
WNetCloseEnum
WNetEnumResourceW
?GetLinkByError@KbLink@@YAXAEBVError@Common@@AEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBUProductProperty@1@_N@Z
?GetLinkByRawInfo@KbLink@@YAXAEAURawInfo@1@AEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBUProductProperty@1@@Z
?GetRawInfoByError@KbLink@@YAXAEBVError@Common@@AEAURawInfo@1@AEBUProductProperty@1@@Z
?SendSerPostQueryToKb@KbLink@@YA?AVError@Common@@AEBV23@AEBUProductProperty@1@_N@Z
?SendSerPostQueryToKbFromRawInfo@KbLink@@YA?AVError@Common@@AEBURawInfo@1@AEBUProductProperty@1@@Z
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ