DllInstall
DllRegisterServer
DllUnregisterServer
StartW
VoidFunc
_cgo_dummy_export
Behavioral task
behavioral1
Sample
c994bb9982dd689598c6c261090a40cb.dll
Resource
win7-20240903-en
Target
c994bb9982dd689598c6c261090a40cb.dll
Size
15.8MB
MD5
c994bb9982dd689598c6c261090a40cb
SHA1
484932042beb27bec5ab6d96df21ec1418c428a6
SHA256
fbce9fc010fdfb67da5ff95cc5a5d1dbb0c07950522f130b031e55831f81b060
SHA512
32fa505bdca420313d62279874ac2ef1383a360502d73f0dfbe010913cc136c103159150b4706f46756e2d8cdea9a7442bc7d8c4cff58a67cfd869874044919b
SSDEEP
196608:rcRl1WLHnSCf24VHfaRpamWwSOsPlebA:8CLkGMadfNgb
resource | yara_rule |
---|---|
sample | SliverRAT_v2 |
Checks for missing Authenticode signature.
resource |
---|
c994bb9982dd689598c6c261090a40cb.dll |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
AddVectoredExceptionHandler
CloseHandle
CreateEventA
CreateFileA
CreateIoCompletionPort
CreateThread
CreateWaitableTimerExW
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
ExitProcess
FreeEnvironmentStringsW
FreeLibrary
GetConsoleMode
GetEnvironmentStringsW
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessAffinityMask
GetQueuedCompletionStatusEx
GetStdHandle
GetSystemDirectoryA
GetSystemInfo
GetThreadContext
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
MultiByteToWideChar
PostQueuedCompletionStatus
ResumeThread
SetConsoleCtrlHandler
SetErrorMode
SetEvent
SetProcessPriorityBoost
SetThreadContext
SetUnhandledExceptionFilter
SetWaitableTimer
Sleep
SuspendThread
SwitchToThread
TlsGetValue
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteConsoleW
WriteFile
__mb_cur_max
_amsg_exit
_beginthread
_errno
_initterm
_iob
_lock
_unlock
abort
atoi
calloc
fputc
free
fwrite
localeconv
malloc
memcpy
memset
realloc
setlocale
strchr
strerror
strlen
strncmp
vfprintf
wcslen
DllInstall
DllRegisterServer
DllUnregisterServer
StartW
VoidFunc
_cgo_dummy_export
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ