GetAccountType
GetName
GetOriginalAccountType
Behavioral task
behavioral1
Sample
0f4272a36ce5e2de155ad69062363f242a8d9fd2fdbbcc21c4c7168c52df74a8.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
0f4272a36ce5e2de155ad69062363f242a8d9fd2fdbbcc21c4c7168c52df74a8.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20240802-en
Target
0f4272a36ce5e2de155ad69062363f242a8d9fd2fdbbcc21c4c7168c52df74a8
Size
116KB
MD5
6126088a7c13e460e4a128b53f46bf7e
SHA1
210049b3bf0d92b2f69777df2b0db032ffc4cc68
SHA256
0f4272a36ce5e2de155ad69062363f242a8d9fd2fdbbcc21c4c7168c52df74a8
SHA512
eb3dbe1118c82a21a3727e4cf79fdbabdc4ab7efd03709ca888cfa89075c2b85f3db8920423436ddb1bde8a9798f687f2604d44ec5b683e263c9aa8d4a73173b
SSDEEP
1536:n49WSmYsVgKJyNmdvroEZonzgL6sbJMx2X0Y+l6ecCQ:nfSEVgKYgdzCgL18K0a/CQ
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
0f4272a36ce5e2de155ad69062363f242a8d9fd2fdbbcc21c4c7168c52df74a8 |
unpack001/$PLUGINSDIR/UserInfo.dll |
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetVersion
GetCurrentThread
lstrcpynA
GetCurrentProcess
GetModuleHandleA
GetProcAddress
GetLastError
GlobalFree
CloseHandle
GlobalAlloc
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
GetUserNameA
OpenThreadToken
GetAccountType
GetName
GetOriginalAccountType
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ