Hookoff
Hookon
Static task
static1
Behavioral task
behavioral1
Sample
0195b890472d045e15406a4f1c0008857901208f75c34638712f61055be82efbN.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0195b890472d045e15406a4f1c0008857901208f75c34638712f61055be82efbN.dll
Resource
win10v2004-20241007-en
Target
0195b890472d045e15406a4f1c0008857901208f75c34638712f61055be82efbN
Size
13KB
MD5
2d6bb9d8a7881562fbd3b47e1edff880
SHA1
c9ec3de7257d0f22690dbf76a80de4c86b406f93
SHA256
0195b890472d045e15406a4f1c0008857901208f75c34638712f61055be82efb
SHA512
2f3ad03d86410e53a8b677ea9348fed9e6882e8867c6fff260d4fde6ca24454b00ba0bf693916987b2e218b8eb0d122130d47bc7678ecd906356340bf0f85771
SSDEEP
192:z4p+9L04QYtTElLFnnY1VsRlo40pQ+dL+R3+rPK3c5Zq7:+mjT6dEVsrV+dHCd7
Checks for missing Authenticode signature.
resource |
---|
0195b890472d045e15406a4f1c0008857901208f75c34638712f61055be82efbN |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
OutputDebugStringA
VirtualProtect
Sleep
lstrcmpA
lstrcatA
lstrcmpiA
lstrcpyA
ExitProcess
lstrlenA
GetTickCount
lstrcpynA
FreeLibrary
GetProcAddress
LoadLibraryA
GetSystemDirectoryA
WritePrivateProfileStringA
GetTempPathA
ExpandEnvironmentStringsA
GetPrivateProfileStringA
GetModuleFileNameA
GetModuleHandleA
CloseHandle
ReadFile
SetFilePointer
CreateFileA
CreateThread
UnmapViewOfFile
MapViewOfFile
OpenFileMappingA
GetLastError
CreateMutexA
SetWindowsHookExA
UnhookWindowsHookEx
PostThreadMessageA
CallNextHookEx
InternetCloseHandle
InternetReadFile
HttpQueryInfoA
InternetOpenUrlA
InternetOpenA
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
Hookoff
Hookon
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ