CancelDll
LoadDll
Behavioral task
behavioral1
Sample
1ea273d0c6d27c281cf2b9c7444d16e55737550cbc901efd36fe7227d4e797c3.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1ea273d0c6d27c281cf2b9c7444d16e55737550cbc901efd36fe7227d4e797c3.dll
Resource
win10v2004-20220812-en
Target
1ea273d0c6d27c281cf2b9c7444d16e55737550cbc901efd36fe7227d4e797c3
Size
90KB
MD5
2cc469769025517d49c589abad2e51c3
SHA1
611f879d96929ded51cb61b8f94ee10bb2fd269a
SHA256
1ea273d0c6d27c281cf2b9c7444d16e55737550cbc901efd36fe7227d4e797c3
SHA512
97480de607193fce25dbcbb2f36bff7b51adc15e9d8a2dab7f4777781086d11c730fe08350391a5e34a1a226da34320eb99b838666b3c706ac0bdbd130ecd9a0
SSDEEP
1536:Axxum8ensPyi5vyWOJ7DPFl/th2lCCZpGOejR71FF3wyrs5ZJ/Qazc3RNwXR:ATumL+yiKL7ralPHFC73F3LrsyYR
resource | yara_rule |
---|---|
sample | vmprotect |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
GetModuleFileNameA
WritePrivateProfileStringA
GetWindowsDirectoryA
IsBadStringPtrW
Module32Next
Module32First
CreateToolhelp32Snapshot
DeleteFileA
GetTempPathA
CreateFileMappingA
GetFileAttributesW
ReadProcessMemory
VirtualQueryEx
WideCharToMultiByte
GetPrivateProfileStringA
GetFileSize
CreateFileA
GetModuleHandleA
CreateThread
SetFilePointer
HeapAlloc
GetProcessHeap
OutputDebugStringA
OpenProcess
TerminateProcess
GetCurrentProcess
Sleep
GetCurrentThreadId
OpenFileMappingA
MapViewOfFile
UnmapViewOfFile
CloseHandle
GetProcAddress
LoadLibraryA
ReadFile
FreeLibrary
GetKeyboardState
GetDC
GetWindowRect
wvsprintfA
UnhookWindowsHookEx
CallNextHookEx
SendMessageA
GetClassNameW
wsprintfA
SetWindowsHookExA
ToAscii
GetWindowThreadProcessId
AttachThreadInput
GetFocus
FindWindowA
GetWindow
DeleteUrlCacheEntry
URLDownloadToFileA
DeleteDC
DeleteObject
BitBlt
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
GetDeviceCaps
CreateDCA
wcslen
_strcmpi
time
srand
wcscpy
wcsstr
exit
printf
rand
strstr
strrchr
strncpy
malloc
_stricmp
tolower
_vsnprintf
_ltoa
_strupr
wcsncat
memset
sprintf
strcpy
??3@YAXPAX@Z
wcscmp
??2@YAPAXI@Z
fclose
ftell
fseek
fopen
mbstowcs
_except_handler3
strlen
memcpy
free
CancelDll
LoadDll
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ