DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
JmpHookOff
MyHookOn
Behavioral task
behavioral1
Sample
d975bc0a6eb497b36d8ba775fb445d3d40f171bf572ecc89bc086438197c9146.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
d975bc0a6eb497b36d8ba775fb445d3d40f171bf572ecc89bc086438197c9146.dll
Resource
win10v2004-20221111-en
Target
d975bc0a6eb497b36d8ba775fb445d3d40f171bf572ecc89bc086438197c9146
Size
56KB
MD5
6f5a5e7669f6ff91ee87102ba985e954
SHA1
087e3ec8bfff9217c221b621b113d12a768a192d
SHA256
d975bc0a6eb497b36d8ba775fb445d3d40f171bf572ecc89bc086438197c9146
SHA512
1cff5a92ecc6cb762b57988e76b4d080d21f5a632ea3a3b09153e426435ba2b8b9bbcce19910e6d7aa8f1852b1426649d36712d288e91292f34e121100803613
SSDEEP
1536:g0qiQWEVy27b0RJOT6wdEiHCj/GV/1uR/04p:Bmg27b0LtlAV/1uRs4p
resource | yara_rule |
---|---|
sample | modiloader_stage2 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
JmpHookOff
MyHookOn
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ