����DLL�ӿ�
Behavioral task
behavioral1
Sample
eabda8bacc9772ef8d528a47fe9d9dcbb589b9a7db410972c3e332346434e7ef.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
eabda8bacc9772ef8d528a47fe9d9dcbb589b9a7db410972c3e332346434e7ef.dll
Resource
win10v2004-20221111-en
General
-
Target
eabda8bacc9772ef8d528a47fe9d9dcbb589b9a7db410972c3e332346434e7ef
-
Size
2.8MB
-
MD5
cc13fc01be4af136e42c2296fb0801ac
-
SHA1
10682bca093fa2e32f9873902ebce2518264f86d
-
SHA256
eabda8bacc9772ef8d528a47fe9d9dcbb589b9a7db410972c3e332346434e7ef
-
SHA512
e42d4f81cdcf9cda52831a8cc59513d6513ecc9454c985280c6003ca4d05af200ab3e56c3273d91f0a85a5fca201fae33c756e344693a0c32f86e845a2ef40fd
-
SSDEEP
49152:UHslDt2okV9wob/fsuY3IOY4Swtus8nBXPVmVP+E0:nJ2okV9wob7Br7s6d
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
eabda8bacc9772ef8d528a47fe9d9dcbb589b9a7db410972c3e332346434e7ef.dll windows x86
135c84727a32dc6d3e0e66d302bac520
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetEndOfFile
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
OffsetRect
MessageBoxA
gdi32
StretchBlt
winmm
waveOutOpen
msimg32
GradientFill
winspool.drv
DocumentPropertiesA
advapi32
RegOpenKeyExA
shell32
DragQueryFileA
ole32
OleUninitialize
oleaut32
LoadTypeLi
comctl32
ImageList_DragLeave
ws2_32
inet_ntoa
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 492KB - Virtual size: 490KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 104KB - Virtual size: 393KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 108KB - Virtual size: 107KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 692KB - Virtual size: 689KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp2 Size: 104KB - Virtual size: 101KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 68KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ