Sdfghjkli
ServiceMain
Behavioral task
behavioral1
Sample
b0c777924fa3dcab8e19781afc09c266950e32ec3e54d43e887675d45948a561.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b0c777924fa3dcab8e19781afc09c266950e32ec3e54d43e887675d45948a561.dll
Resource
win10v2004-20220812-en
Target
b0c777924fa3dcab8e19781afc09c266950e32ec3e54d43e887675d45948a561
Size
98KB
MD5
644327b0893da4aea842fce7c11a4fdb
SHA1
35bc5cbb1d4e8e98c052403b482aa6462776442c
SHA256
b0c777924fa3dcab8e19781afc09c266950e32ec3e54d43e887675d45948a561
SHA512
23c38eb2dc76f51caa032d91b1ada3c9cab0be9591b86226098df338aa7bdce62e0aa452934844dfd8ec7efb556ccfaf9513295cdd61c1667947658d698307c4
SSDEEP
3072:/Hq0ol/CLm89a/CwxCEKJ5oTLGCXeEZqU4dpnQMFS:PwlrsaXKPKCUPqLdp3FS
resource | yara_rule |
---|---|
sample | vmprotect |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
RegCloseKey
CreateServiceA
StartServiceA
RegisterServiceCtrlHandlerA
SetServiceStatus
RegEnumValueA
RegEnumKeyExA
RegDeleteValueA
QueryServiceConfigA
EnumServicesStatusA
ChangeServiceConfigA
RegCreateKeyExA
RegSetValueExA
OpenProcessToken
RegOpenKeyExA
RegQueryValueExA
OpenServiceA
GetUserNameW
LookupPrivilegeValueA
ImpersonateSelf
OpenThreadToken
AdjustTokenPrivileges
OpenSCManagerA
DeleteService
ControlService
CloseServiceHandle
capCreateCaptureWindowA
capGetDriverDescriptionA
DeleteObject
CreateCompatibleDC
SelectObject
BitBlt
DeleteDC
GetDeviceCaps
CreateDCA
CreateCompatibleBitmap
GetDIBits
ImmReleaseContext
ImmGetCompositionStringW
ImmGetCompositionStringA
ImmGetContext
lstrcatW
lstrlenW
OpenProcess
CreateDirectoryA
MoveFileA
GetDriveTypeA
GetVolumeInformationA
GetDiskFreeSpaceExA
GetLogicalDriveStringsA
GetFileAttributesExA
FindClose
GetLastError
lstrcmp
FindNextFileA
FindFirstFileA
lstrcmpi
Process32Next
Process32First
CreateToolhelp32Snapshot
DuplicateHandle
SetStdHandle
CreatePipe
GetStdHandle
GetEnvironmentVariableA
GetProcAddress
FreeLibrary
LocalAlloc
FlushFileBuffers
RaiseException
OpenEventA
OpenMutexA
GetFileSize
GlobalAlloc
GlobalLock
lstrcpyW
WaitForMultipleObjects
ResetEvent
ReleaseMutex
GlobalFree
CreateEventA
CreateMutexA
GetFileSizeEx
SetFilePointerEx
ReadFile
GetCurrentProcess
GetPriorityClass
GetThreadPriority
SetPriorityClass
SetThreadPriority
QueryPerformanceFrequency
QueryPerformanceCounter
GetVersion
GetVersionExA
TerminateProcess
ResumeThread
GetSystemInfo
GlobalMemoryStatus
GetComputerNameA
GetACP
GetOEMCP
GetLocalTime
GetTempPathA
WriteFile
GetCurrentThread
GetCurrentProcessId
SetFilePointer
WideCharToMultiByte
SearchPathA
InterlockedExchange
LoadLibraryA
GetModuleFileNameA
lstrlen
DeviceIoControl
CreateFileA
CloseHandle
GetSystemDirectoryA
SetEvent
DeleteFileA
lstrcpy
GetCurrentThreadId
GetStartupInfoA
CreateProcessA
Sleep
lstrcat
WaitForSingleObject
GetTickCount
VirtualProtect
GetModuleFileNameA
ExitProcess
malloc
strrchr
__dllonexit
_onexit
_initterm
_adjust_fdiv
wcscmp
free
strchr
_beginthread
__CxxFrameHandler
??2@YAPAXI@Z
??3@YAXPAX@Z
GetModuleFileNameExA
ShellExecuteA
SHFileOperation
SHEmptyRecycleBinA
StrCmpW
StrChrA
StrStrA
StrRChrA
SHDeleteKeyA
StrCmpNIA
StrToIntA
ExitWindowsEx
CallNextHookEx
OpenInputDesktop
GetThreadDesktop
GetMessageA
SetTimer
SetWindowsHookExA
SendInput
SetCursorPos
PostMessageA
OpenDesktopA
GetForegroundWindow
SetWindowsHookExW
GetWindowTextA
GetWindowThreadProcessId
wsprintfW
GetActiveWindow
CharLowerA
PostThreadMessageA
CharUpperA
EnumWindows
UpdateWindow
BringWindowToTop
ShowWindow
DestroyWindow
SetThreadDesktop
MessageBoxA
wsprintfA
UnhookWindowsHookEx
OpenWindowStationA
SetProcessWindowStation
CloseDesktop
CloseWindowStation
IsWindow
SendMessageA
DispatchMessageA
MessageBoxA
waveInUnprepareHeader
waveInPrepareHeader
waveInAddBuffer
waveInStart
waveInStop
waveInClose
waveInOpen
listen
setsockopt
bind
socket
htons
send
select
getsockname
htons
accept
WSAStartup
closesocket
recv
inet_addr
gethostbyname
inet_ntoa
WSASocketA
connect
CreateStreamOnHGlobal
Sdfghjkli
ServiceMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ