1???
??
???��
???��CALL
???��2E4
??����?��??��yD��
?��
?��?��
APC?��????������?
Camel_��?����3��D��?a��?
VMP����?������???a��?
VMP����?������???��?2
����??��??��
��?X��?����
��?Y��?����
��?Z��?����
Behavioral task
behavioral1
Sample
b96f2de9cea9c4ec22abcaed84eee1cdf352d2e123519c4d1305ae8508bde01b.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
b96f2de9cea9c4ec22abcaed84eee1cdf352d2e123519c4d1305ae8508bde01b.dll
Resource
win10v2004-20220812-en
Target
b96f2de9cea9c4ec22abcaed84eee1cdf352d2e123519c4d1305ae8508bde01b
Size
896KB
MD5
4d2e3506764ad7df87812ccc296835e5
SHA1
aefecd2f43709bc693cb37e4b0080970c59837fd
SHA256
b96f2de9cea9c4ec22abcaed84eee1cdf352d2e123519c4d1305ae8508bde01b
SHA512
74dc3881140eeeaaff1a287b49c15f36aede2b811701d70447d91a03578294cd9521eb7d68b444cdcaa5ba6b3df256c76f5adb8866317fb0d1178e3572a09d68
SSDEEP
24576:7fK46aSJKnenpcMLXrxbMYrJrHRc6kFKg+YQAAyC27QPe31:7fhSx9/rVjuJzC2d
resource | yara_rule |
---|---|
sample | vmprotect |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
UnlockFile
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
SetActiveWindow
BitBlt
waveOutClose
DocumentPropertiesA
RegCloseKey
ShellExecuteA
CLSIDFromString
RegisterTypeLi
ImageList_Destroy
accept
GetOpenFileNameA
1???
??
???��
???��CALL
???��2E4
??����?��??��yD��
?��
?��?��
APC?��????������?
Camel_��?����3��D��?a��?
VMP����?������???a��?
VMP����?������???��?2
����??��??��
��?X��?����
��?Y��?����
��?Z��?����
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ