Long
ServiceMain
Zero
Behavioral task
behavioral1
Sample
f383f704a9e1971f4dd6777c2cb30de076452ae4349ee2342da17538689584f9N.dll
Resource
win7-20240903-en
Target
f383f704a9e1971f4dd6777c2cb30de076452ae4349ee2342da17538689584f9N
Size
808KB
MD5
611207aae2c638ef2c6fe3a64e21c100
SHA1
27126ceed8ff6ee6654351c5653f701f9ebbc43f
SHA256
f383f704a9e1971f4dd6777c2cb30de076452ae4349ee2342da17538689584f9
SHA512
621d3c2c8bbef032713d56a7593bc6377977d9c011fc2669f7f7d5c253abb7e2695c0e73a0cf5cfe70b2900210dd06e1d536cd1f6f756c762ce2a85ebc12358f
SSDEEP
3072:NY4DnkogEwAg4EYvjpLOTBCb8sEbhX81Qd4wwuGtq/HYZOqD6666666666666669:Be4EIjoTBIzE1M2Mud/IOh
resource | yara_rule |
---|---|
sample | family_gh0strat |
Checks for missing Authenticode signature.
resource |
---|
f383f704a9e1971f4dd6777c2cb30de076452ae4349ee2342da17538689584f9N |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
LocalFree
FindNextFileA
FindFirstFileA
LocalAlloc
GetFileSize
ReadFile
SetFilePointer
MoveFileA
lstrcatA
CreateProcessA
InitializeCriticalSection
CloseHandle
lstrcmpiA
HeapFree
MapViewOfFile
CreateFileMappingA
UnmapViewOfFile
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
GetStartupInfoA
WaitForMultipleObjects
TerminateProcess
GetCurrentThreadId
GlobalMemoryStatus
GetSystemInfo
GetVersionExA
SetErrorMode
GetCurrentProcess
GetWindowsDirectoryA
SetFileAttributesA
CopyFileA
ExpandEnvironmentStringsA
GetModuleFileNameA
FindClose
LCMapStringW
LCMapStringA
SetStdHandle
FlushFileBuffers
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
IsBadCodePtr
IsBadReadPtr
WriteFile
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetFileType
GetStdHandle
SetHandleCount
UnhandledExceptionFilter
HeapSize
IsBadWritePtr
HeapReAlloc
HeapCreate
HeapDestroy
GetEnvironmentVariableA
SetUnhandledExceptionFilter
ExitProcess
SetLastError
TlsFree
GetVolumeInformationA
GetLogicalDriveStringsA
GetDiskFreeSpaceExA
GetDriveTypeA
GetModuleHandleA
lstrlenA
lstrcpyA
GetFileAttributesA
CreateDirectoryA
GetProcessHeap
HeapAlloc
GetCurrentProcessId
GetLocalTime
GetTickCount
CancelIo
InterlockedExchange
ResetEvent
GetLastError
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
VirtualFree
DeleteCriticalSection
WaitForSingleObject
CreateThread
ResumeThread
SetEvent
Sleep
TerminateThread
FreeLibrary
LoadLibraryA
GetProcAddress
TlsAlloc
GetVersion
RtlUnwind
RaiseException
TlsSetValue
TlsGetValue
ExitThread
InterlockedDecrement
InterlockedIncrement
WideCharToMultiByte
GetCommandLineA
LoadIconA
RegisterClassA
LoadMenuA
CreateWindowExA
CloseWindow
IsWindow
PostMessageA
OpenDesktopA
GetThreadDesktop
GetUserObjectInformationA
SetThreadDesktop
CloseDesktop
IsWindowVisible
GetWindowThreadProcessId
ExitWindowsEx
GetCursorPos
GetCursorInfo
DestroyCursor
ReleaseDC
GetDesktopWindow
GetDC
SetRect
GetSystemMetrics
GetClipboardData
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
mouse_event
SetCursorPos
WindowFromPoint
SetCapture
MapVirtualKeyA
SendMessageA
LoadCursorA
MessageBoxA
GetWindowTextA
wsprintfA
CharNextA
GetMessageA
TranslateMessage
DispatchMessageA
OpenInputDesktop
GetStockObject
RegRestoreKeyA
RegSaveKeyA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
StartServiceA
CreateServiceA
LockServiceDatabase
ChangeServiceConfig2A
UnlockServiceDatabase
RegOpenKeyA
InitializeSecurityDescriptor
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
FreeSid
OpenSCManagerA
OpenServiceA
DeleteService
CloseServiceHandle
RegCreateKeyExA
OpenEventLogA
ClearEventLogA
CloseEventLog
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegDeleteKeyA
SHGetSpecialFolderPathA
Long
ServiceMain
Zero
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ