Benign Download

DLL%E3%82%B5%E3%82%A4%E3%83%89%E3%83%AD%E3%83%BC%E3%83%87%E3%82%A3%E3%83%B3%E3%82%B0

HTTP flood terminologyContains Hiragana or Katakana script
SHA-256bb477a1dc6067d7fe4dbea4a14b1cc80c8dfd9d71dcccc7f848a560d11d34edc
MaleculeO(I)H(F)Md

Evidence

Contains Hiragana or Katakana script lines 1–12
1<!DOCTYPE html>
2<html class="client-nojs vector-feature-language-in-header-enabled vector-feature-language-in-main-menu-disabled vector-feature-language-in-main-page-header-disabled vector-feature-page-tools-pinned-disabled vector-feature-toc-pinned-clientpref-1 vector-feature-main-menu-pinned-disabled vector-feature-limited-width-clientpref-1 vector-feature-limited-width-content-enabled vector-feature-custom-font-size-clientpref-1 vector-feature-appearance-pinned-clientpref-1 skin-theme-clientpref-day vector-feature-navigation-update-disabled vector-sticky-header-enabled vector-toc-available skin-thumbsize-clientpref-standard" lang="ja" dir="ltr">
3<head>
4<meta charset="UTF-8">
5<title>DLLサイドローディング - Wikipedia</title>
6<script>(function(){var className="client-js vector-feature-language-in-header-enabled vector-feature-language-in-main-menu-disabled vector-feature-language-in-main-page-header-disabled vector-feature-page-tools-pinned-disabled vector-feature-toc-pinned-clientpref-1 vector-feature-main-menu-pinned-disabled vector-feature-limited-width-clientpref-1 vector-feature-limited-width-content-enabled vector-feature-custom-font-size-clientpref-1 vector-feature-appearance-pinned-clientpref-1 skin-theme-clientpref-day vector-feature-navigation-update-disabled vector-sticky-header-enabled vector-toc-available skin-thumbsize-clientpref-standard";var cookie=document.cookie.match(/(?:^|; )jawikimwclientpreferences=([^;]+)/);if(cookie){cookie[1].split('%2C').forEach(function(pref){className=className.replace(new RegExp('(^| )'+pref.replace(/-clientpref-\w+$|[^\w-]+/g,'')+'-clientpref-\\w+( |$)'),'$1'+pref+'$2');});}document.documentElement.className=className;}());RLCONF={"wgBreakFrames":false,"wgSeparatorTransformTable":["",
7RLSTATE={"ext.gadget.PDFLinkIcon":"ready","ext.gadget.RedirectColor":"ready","ext.globalCssJs.user.styles":"ready","site.styles":"ready","user.styles":"ready","ext.globalCssJs.user":"ready","user":"ready","user.options":"loading","ext.cite.parsoid.styles":"ready","ext.cite.styles":"ready","mediawiki.skinning.content.parsoid":"ready","ext.wikimediamessages.styles":"ready","skins.vector.search.codex.styles":"ready","skins.vector.styles":"ready","skins.vector.icons":"ready","jquery.makeCollapsible.styles":"ready","ext.visualEditor.desktopArticleTarget.noscript":"ready","ext.uls.interlanguage":"ready","wikibase.client.init":"ready"};RLPAGEMODULES=["ext.cite.ux-enhancements","site","mediawiki.page.ready","jquery.makeCollapsible","mediawiki.toc","skins.vector.js","ext.centralNotice.geoIP","ext.centralNotice.startUp","ext.gadget.NormalizeCharWidth","ext.gadget.suppressEnterAtSummaryBox","ext.gadget.checkSignature","ext.gadget.charinsert","ext.gadget.WikiMiniAtlas","ext.gadget.switcher","ext.gadget.protectionIndicato
8<script>(RLQ=window.RLQ||[]).push(function(){mw.loader.impl(function(){return["user.options@12s5i",function($,jQuery,require,module){mw.user.tokens.set({"patrolToken":"+\\","watchToken":"+\\","csrfToken":"+\\"});
9}];});});</script>
10<link rel="stylesheet" href="/w/load.php?lang=ja&amp;modules=ext.cite.parsoid.styles%7Cext.cite.styles%7Cext.uls.interlanguage%7Cext.visualEditor.desktopArticleTarget.noscript%7Cext.wikimediamessages.styles%7Cjquery.makeCollapsible.styles%7Cmediawiki.skinning.content.parsoid%7Cskins.vector.icons%2Cstyles%7Cskins.vector.search.codex.styles%7Cwikibase.client.init&amp;only=styles&amp;skin=vector-2022">
11<script async="" src="/w/load.php?lang=ja&amp;modules=startup&amp;only=scripts&amp;raw=1&amp;skin=vector-2022"></script>
12<meta name="ResourceLoaderDynamicStyles" content="">
Contains an HTTPS URL prefix lines 26–34
26<link rel="search" type="application/opensearchdescription+xml" href="/w/rest.php/v1/search" title="Wikipedia (ja)">
27<link rel="EditURI" type="application/rsd+xml" href="//ja.wikipedia.org/w/api.php?action=rsd">
28<link rel="canonical" href="https://ja.wikipedia.org/wiki/DLL%E3%82%B5%E3%82%A4%E3%83%89%E3%83%AD%E3%83%BC%E3%83%87%E3%82%A3%E3%83%B3%E3%82%B0">
29<link rel="license" href="https://creativecommons.org/licenses/by-sa/4.0/deed.ja">
30<link rel="alternate" type="application/atom+xml" title="Wikipediaの Atom フィード" href="/w/index.php?title=%E7%89%B9%E5%88%A5:%E6%9C%80%E8%BF%91%E3%81%AE%E6%9B%B4%E6%96%B0&amp;feed=atom">
31<link rel="dns-prefetch" href="//meta.wikimedia.org" />
32<link rel="dns-prefetch" href="auth.wikimedia.org">
33</head>
34<body class="skin--responsive skin-vector skin-vector-search-vue mediawiki ltr sitedir-ltr mw-hide-empty-elt ns-0 ns-subject mw-editable page-DLLサイドローディング rootpage-DLLサイドローディング skin-vector-2022 action-view">
References the C:\\Windows\\System32\\ directory line 850
850<p id="mwWw">このどちらの方式であっても、プログラムがDLLを呼び出す際に『C:\Windows\System32\example.dll』のようなフルパス(絶対パス)を指定せず、単にファイル名だけで読み込みを要求するケースが一般的である。この点が、サイドローディングを含むハイジャック攻撃の根本的な原因となる。</p>
Office/Productivity application names lines 884–885
884</section><section data-mw-section-id="8" id="mwrw" aria-labelledby="防御回避"><div class="mw-heading mw-heading3"><h3 id="防御回避"><span id=".E9.98.B2.E5.BE.A1.E5.9B.9E.E9.81.BF" typeof="mw:FallbackId"></span>防御回避</h3><span class="mw-editsection"><span class="mw-editsection-bracket">[</span><a href="/w/index.php?title=DLL%E3%82%B5%E3%82%A4%E3%83%89%E3%83%AD%E3%83%BC%E3%83%87%E3%82%A3%E3%83%B3%E3%82%B0&amp;action=edit&amp;section=8" title="節を編集: 防御回避"><span>編集</span></a><span class="mw-editsection-bracket">]</span></span></div>
885<p id="mwsA">サイドローディングの最大の利点は、既存のセキュリティ制御を回避できる点にある。「MicrosoftやAdobeによって署名されたバイナリ」の実行を許可する設定になっている場合、ホストプロセスは正規の署名を持っているため、実行が許可されてしまう<sup about="#mwt38" class="mw-ref reference" id="cite_ref-Cybereason2026_1-4" rel="dc:references" typeof="mw:Extension/ref" data-mw='{"name":"ref","attrs":{"name":"Cybereason2026"}}'><a href="#cite_note-Cybereason2026-1" id="mwsQ"><span class="mw-reflink-text" id="mwsg"><span class="cite-bracket" id="mwsw">[</span>1<span class="cite-bracket" id="mwtA">]</span></span></a></sup>。また、 外部へのネットワーク通信や不審なAPIコールが、信頼されたプロセス(例: Outlook.exeやTeams.exe、MsMpEng.exe)から発生しているように見えるため、ファイアウォールのルールをすり抜けたり、SOCアナリストの調査に�
HTTP flood terminology lines 1039–1043
1039<li><a rel="mw:WikiLink" href="//ja.wikipedia.org/wiki/SYN_flood" title="SYN flood">SYN flood</a></li>
1040<li><a rel="mw:WikiLink" href="//ja.wikipedia.org/wiki/UDPフラッド攻撃" title="UDPフラッド攻撃">UDPフラッド攻撃</a></li>
1041<li><a rel="mw:WikiLink" href="//ja.wikipedia.org/wiki/HTTP_Flood" title="HTTP Flood">HTTP Flood</a></li>
1042<li><a rel="mw:WikiLink" href="//ja.wikipedia.org/wiki/PDoS攻撃" title="PDoS攻撃">PDoS攻撃</a></li>
1043<li><a rel="mw:WikiLink" href="//ja.wikipedia.org/wiki/スローロリス_(DOS攻撃ツール)" title="スローロリス (DOS攻撃ツール)">スローロリス_(DOS攻撃ツール)</a></li>

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.