Install
Uninstall
Behavioral task
behavioral1
Sample
a4a21af5bde06cfe0edbfe6e400aa16743bd049fa43ccae299ee9e1e7ac65d59.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a4a21af5bde06cfe0edbfe6e400aa16743bd049fa43ccae299ee9e1e7ac65d59.dll
Resource
win10v2004-20221111-en
Target
a4a21af5bde06cfe0edbfe6e400aa16743bd049fa43ccae299ee9e1e7ac65d59
Size
669KB
MD5
9d995e92151554d02fa2a0717be607ce
SHA1
ed40d1d4b4a5c506739b9929f8287368b8f1b9c5
SHA256
a4a21af5bde06cfe0edbfe6e400aa16743bd049fa43ccae299ee9e1e7ac65d59
SHA512
0f8f0ee07b37822babc3a15202eee291aa5a27828809fe8382e5e6e4b930d6648baacb5bb29173144bd669c51d777d114b1c7cdd7779dba06bcda26429342b3c
SSDEEP
12288:bKLkQcwEM6zJLKusSXUC1QHbBJOosm59aAxnkIxnxM7FD8iz5AqsVugYfZIsWizc:moQDEMsJIDCG9sm59a0nkIhxo8izOtYb
resource | yara_rule |
---|---|
sample | vmprotect |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PlaySoundA
ord1570
strtok
lstrcpyA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
GetFocus
OpenProcessToken
MapFileAndCheckSumA
EmptyWorkingSet
PathRemoveFileSpecA
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
Install
Uninstall
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ