GetNeedSock
WSPStartup
Behavioral task
behavioral1
Sample
9312211fffc2ae363af6f0b1bb074c60504d0ba74938f5e47e06622fbbc472d3.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9312211fffc2ae363af6f0b1bb074c60504d0ba74938f5e47e06622fbbc472d3.dll
Resource
win10v2004-20221111-en
Target
9312211fffc2ae363af6f0b1bb074c60504d0ba74938f5e47e06622fbbc472d3
Size
73KB
MD5
f1b403da96a2fe3e0740411d0be91b80
SHA1
6ad7ee9dd52a4e7183940339cbab4ac13eaf7e05
SHA256
9312211fffc2ae363af6f0b1bb074c60504d0ba74938f5e47e06622fbbc472d3
SHA512
e30a182fbda3bfdf48f4556f2fdd0af768ed62bc7c9464b4e8f3ff03170c192f0d0a595ae5ce3b8da6627d8d9377ff4c598fdcba0c11c91882fe66f0862aada4
SSDEEP
1536:w00M29IodAzll3dJBYU/briHvVHeujS6nbpc8UbTJ26vv:RYdcr/bQHeu7nVkN
Processes:
resource | yara_rule |
---|---|
sample | vmprotect |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
VirtualAlloc
DisableThreadLibraryCalls
GetModuleFileNameA
GetModuleHandleA
CreateMutexA
CloseHandle
GetCurrentProcessId
DeleteFileA
CreateThread
lstrcpyA
GlobalAlloc
GlobalFree
LoadLibraryW
VirtualFree
ExpandEnvironmentStringsW
GetProcAddress
VirtualProtect
GetTempPathA
WritePrivateProfileStringA
GetComputerNameA
GetLastError
WriteProfileStringA
GetPrivateProfileStringA
GetProfileStringA
WideCharToMultiByte
OutputDebugStringA
CreateToolhelp32Snapshot
Process32First
Process32Next
TerminateProcess
OpenProcess
UnmapViewOfFile
IsBadReadPtr
LoadLibraryA
ExitThread
GetLocalTime
FormatMessageA
LocalFree
TerminateThread
GetCommandLineA
WinExec
lstrcatA
GetSystemDirectoryA
ReadFile
Sleep
WriteFile
GetTickCount
ExitProcess
FreeLibrary
SetFilePointer
GetFileSize
CreateFileA
lstrlenA
wsprintfA
GetWindowLongA
CharLowerA
GetKeyboardState
MessageBoxA
GetMessageW
MapVirtualKeyA
ToAscii
FindWindowA
PostMessageA
DefWindowProcA
PostQuitMessage
SendMessageA
DispatchMessageA
TranslateMessage
GetMessageA
UpdateWindow
ShowWindow
CreateWindowExW
RegisterClassW
wsprintfW
LoadIconA
LoadCursorA
GetWindowTextA
GetStockObject
ShellExecuteA
closesocket
sendto
gethostbyname
setsockopt
recvfrom
WSAAsyncSelect
htonl
bind
listen
WSACleanup
connect
WSAConnect
ntohs
getsockname
accept
WSAGetLastError
WSARecv
WSAAsyncGetHostByName
getpeername
WSASend
select
__WSAFDIsSet
ioctlsocket
htons
inet_addr
WSAStartup
recv
send
WSCGetProviderPath
WSCEnumProtocols
inet_ntoa
socket
memcpy
wcsstr
_itoa
sprintf
atoi
srand
rand
strncmp
strncpy
??2@YAPAXI@Z
??3@YAXPAX@Z
_errno
_stricmp
_strnicmp
memset
strstr
PathFileExistsA
PathRemoveFileSpecA
InternetOpenUrlA
InternetOpenA
InternetCloseHandle
InternetReadFile
GetNeedSock
WSPStartup
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ