3:49735 v ersion: TL S 1.2Ĭhecks for available system drives (often done to infect USB drives)Ĭontains functionality to enumerate / list files inside a directoryĬode function: 0_2_004320 28 GetVers ion,GetFil eAttribute sW,FindFir stFileW,De leteFileW, FindNextFi leW,FindCl ose,Remove DirectoryW ,GetFileAt tributesA, FindFirstF ileA,Delet eFileA,Fin dNextFileA ,FindClose ,RemoveDir ectoryA,Ĭode function: 0_2_004060 C8 GetModu leHandleA, GetProcAdd ress,lstrc pyn,lstrcp yn,lstrcpy n,FindFirs tFileA,Fin dClose,lst rcpyn,lstr cpyn,Ĭode function: 0_2_004220 A4 GetVers ion,FindFi rstFileA,F indFirstFi leW,FindCl ose,FileTi meToDosDat eTime,Ĭode function: 0_2_004593 00 GetVers ion,GetUse rNameW,Get UserNameA, GetVersion ,GetVersio n,GetModul eHandleA,G etProcAddr ess,GetWin dowsDirect oryA,GetCu rrentProce ssId,GetVe rsion,GetC ommandLine W,GetComma ndLineA,Ge tModuleHan dleA,GetVe rsion,Find FirstFileW ,FindFirst FileA,Find Close,File TimeToLoca lFileTime, FileTimeTo SystemTime ,GetModule HandleA,Ge tModuleHan dleA,Ĭode function: 0_2_00420C FC GetVers ion,FindFi rstFileA,F indFirstFi leW,FindCl ose, Uses secure TLS version for HTTPS connections Static PE information: certificat e valid Static PE information: LOCAL_SYMS _STRIPPED, 32BIT_MAC HINE, BYTE S_REVERSED _LO, EXECU TABLE_IMAG E, LINE_NU MS_STRIPPE D, BYTES_R EVERSED_HI Source: C:\Users\u ser\Deskto p\PrivaZer. exe PID: 5440ĭLL planting / hijacking vulnerabilities found
0 kommentar(er)
