InitValue
InitValue_Ex
NtvbldHelper
Static task
static1
Behavioral task
behavioral1
Sample
e74ebf5081cbe62b7882ad28593ef981d0feb292936e646d32b332fdfe3ddd06.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
e74ebf5081cbe62b7882ad28593ef981d0feb292936e646d32b332fdfe3ddd06.dll
Resource
win10v2004-20240802-en
Target
e74ebf5081cbe62b7882ad28593ef981d0feb292936e646d32b332fdfe3ddd06
Size
44KB
MD5
7ceeab39ddd8e1e5a1d51e146200c84a
SHA1
b5c26cac78fd48f1c16d6cfb9ec5ee39aa1a6d65
SHA256
e74ebf5081cbe62b7882ad28593ef981d0feb292936e646d32b332fdfe3ddd06
SHA512
dc48df34956879e2a172dfdb61e049bc3790d3cfdab0b909bc08eb93e3253782401c9148da9ad2fb6152578e0467497859599066d2b3d13a8be6ab2d3849d78e
SSDEEP
384:MGDMvlq+9hsb7PeYDGOpQSPlVU8Vczo/CQSwhdo99n2AyCvF3ILd9:MGgHfqCaczo/ZinYCed9
Checks for missing Authenticode signature.
resource |
---|
e74ebf5081cbe62b7882ad28593ef981d0feb292936e646d32b332fdfe3ddd06 |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
memcpy
_stricmp
NtAllocateVirtualMemory
NtProtectVirtualMemory
RtlAnsiStringToUnicodeString
strlen
wcslen
RtlFreeUnicodeString
memset
strcmp
NtReadVirtualMemory
LdrLoadDll
_wcsicmp
NtOpenKey
RtlInitUnicodeString
RtlInitAnsiString
NtWriteVirtualMemory
LdrGetProcedureAddress
RtlInitString
NtClose
NtQueryValueKey
NtFreeVirtualMemory
LdrGetDllHandle
__C_specific_handler
InitValue
InitValue_Ex
NtvbldHelper
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ