RunDllHostCallBack
qgsl
Behavioral task
behavioral1
Sample
4d0e252671ac6a8bffe878a443a5f1ccd3b29b1d90c83e1d595e09a48041f452.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4d0e252671ac6a8bffe878a443a5f1ccd3b29b1d90c83e1d595e09a48041f452.dll
Resource
win10v2004-20220812-en
Target
4d0e252671ac6a8bffe878a443a5f1ccd3b29b1d90c83e1d595e09a48041f452
Size
988KB
MD5
3b5661210b6cf37d661ec3220dd95f00
SHA1
570acf0bb0cf24861c83dacbc1eed8362ae551d5
SHA256
4d0e252671ac6a8bffe878a443a5f1ccd3b29b1d90c83e1d595e09a48041f452
SHA512
61999242503c6122e60f5ffd0dc06aeb4ca1a7e1309b34d910c1df9d436b407e9fbe66f67da51df216e51b34c6c0de9ebbc6cf5d3ea9b86dd87d987c196b3aaa
SSDEEP
24576:aNZmf90pY2qhj/igugSU0ag1tfWclklj3NfbwAXWm:oZmVX2qB/FTg1A0kljxbw2
resource | yara_rule |
---|---|
sample | vmprotect |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
FindFirstFileA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
CopyRect
SetPolyFillMode
midiStreamRestart
OpenPrinterA
RegSetValueExA
Shell_NotifyIconA
OleUninitialize
UnRegisterTypeLi
ord17
inet_ntoa
GetOpenFileNameA
RunDllHostCallBack
qgsl
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ