CancelDll
LoadDll
Behavioral task
behavioral1
Sample
c1414c7fdbbf459f76c755f23b457eb2ebeb8d4eca2611ca834be699493443c4.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
c1414c7fdbbf459f76c755f23b457eb2ebeb8d4eca2611ca834be699493443c4.dll
Resource
win10v2004-20220901-en
Target
c1414c7fdbbf459f76c755f23b457eb2ebeb8d4eca2611ca834be699493443c4
Size
82KB
MD5
7362fe2d92269b9e50c3e458d6d0402b
SHA1
14021e88b0184eff09de9c19e9d7f1fc46a9674e
SHA256
c1414c7fdbbf459f76c755f23b457eb2ebeb8d4eca2611ca834be699493443c4
SHA512
3c1967252b92cabfc29a0efe4d8fd0cda2403a08695f77f8db7790d536836de2888569891b84de89f7f253e784f4ea1b6b348f151e11e2b11f9a54112c86ac11
SSDEEP
1536:Axxum8ensPyi5vyWOJ7DPFl/th2lCCZpGMFIoO9r2G142bxjaXNTz/tluNiR/og:ATumL+yiKL7ralPHTs2ygXNTzfu0ig
resource | yara_rule |
---|---|
sample | vmprotect |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
GetModuleFileNameA
WritePrivateProfileStringA
GetWindowsDirectoryA
IsBadStringPtrW
Module32Next
Module32First
CreateToolhelp32Snapshot
DeleteFileA
GetTempPathA
CreateFileMappingA
GetFileAttributesW
ReadProcessMemory
VirtualQueryEx
WideCharToMultiByte
GetPrivateProfileStringA
GetFileSize
CreateFileA
GetModuleHandleA
CreateThread
SetFilePointer
HeapAlloc
GetProcessHeap
OutputDebugStringA
OpenProcess
TerminateProcess
GetCurrentProcess
Sleep
GetCurrentThreadId
OpenFileMappingA
MapViewOfFile
UnmapViewOfFile
CloseHandle
GetProcAddress
LoadLibraryA
ReadFile
FreeLibrary
GetKeyboardState
GetDC
GetWindowRect
wvsprintfA
UnhookWindowsHookEx
CallNextHookEx
SendMessageA
GetClassNameW
wsprintfA
SetWindowsHookExA
ToAscii
GetWindowThreadProcessId
AttachThreadInput
GetFocus
FindWindowA
GetWindow
DeleteUrlCacheEntry
URLDownloadToFileA
DeleteDC
DeleteObject
BitBlt
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
GetDeviceCaps
CreateDCA
wcslen
_strcmpi
time
srand
wcscpy
wcsstr
exit
printf
rand
strstr
strrchr
strncpy
malloc
_stricmp
tolower
_vsnprintf
_ltoa
_strupr
wcsncat
memset
sprintf
strcpy
??3@YAXPAX@Z
wcscmp
??2@YAPAXI@Z
fclose
ftell
fseek
fopen
mbstowcs
_except_handler3
strlen
memcpy
free
CancelDll
LoadDll
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ