����DLL�ӿ�
Behavioral task
behavioral1
Sample
69743e3959df0f336b9fbd7716460866881cf2ab52a8e4da9785936c4adae982.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
69743e3959df0f336b9fbd7716460866881cf2ab52a8e4da9785936c4adae982.dll
Resource
win10v2004-20220812-en
General
-
Target
69743e3959df0f336b9fbd7716460866881cf2ab52a8e4da9785936c4adae982
-
Size
1.6MB
-
MD5
b8b1b658fc530d071373fc9e00088d99
-
SHA1
48a1b5eb22f32a136586b5f21059c37c05671523
-
SHA256
69743e3959df0f336b9fbd7716460866881cf2ab52a8e4da9785936c4adae982
-
SHA512
a95cbe588fd2c1596b6861f8622614bd9c295e8a20b09846cadf5b231226359ccc08e716b9398e2fa2456624527b04a505a8cbc572d0dbd721525ff84fdfa71f
-
SSDEEP
49152:y1+o9pj+c/KzcTrnh2Aax/t7kQW6xTAX:pspSc/KzcTrnh2Aax/tYlQTA
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
69743e3959df0f336b9fbd7716460866881cf2ab52a8e4da9785936c4adae982.dll windows x86
d5717180e300dfd5c0050d8913c0b1c0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutClose
ws2_32
WSAAsyncSelect
kernel32
LCMapStringA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
IsWindowVisible
gdi32
RealizePalette
winspool.drv
ClosePrinter
advapi32
RegCloseKey
shell32
DragAcceptFiles
ole32
OleInitialize
oleaut32
LoadTypeLi
comctl32
ImageList_Read
comdlg32
GetOpenFileNameA
Exports
Exports
Sections
.text Size: 668KB - Virtual size: 666KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 176KB - Virtual size: 173KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 64KB - Virtual size: 241KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 92KB - Virtual size: 90KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 512KB - Virtual size: 509KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 96KB - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ