StartSpy
StopSpy
Behavioral task
behavioral1
Sample
024977784be74e98400cd86ad18c7a545669e51a63032c7eb32da6d42c475fc0.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
024977784be74e98400cd86ad18c7a545669e51a63032c7eb32da6d42c475fc0.dll
Resource
win10v2004-20230220-en
Target
024977784be74e98400cd86ad18c7a545669e51a63032c7eb32da6d42c475fc0
Size
857KB
MD5
f95106721586733deae27ac84aadc632
SHA1
6c7e7b8017a54ef75520d1204aa8b378dc8b9ed8
SHA256
024977784be74e98400cd86ad18c7a545669e51a63032c7eb32da6d42c475fc0
SHA512
6de081bafc4a41776ffa1101a68fd59dbd0b944ef7e136d7b09ce36f30bb99cec4928e395a7100e92e5920c4deb7482f741cdd01ff6f3f411e8a09b56795c809
SSDEEP
24576:FZXb6Awq2khZ4MFcucNzziUiebWwDQeA/VEa0:TXfXVyyUisZtIEa
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
024977784be74e98400cd86ad18c7a545669e51a63032c7eb32da6d42c475fc0 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
MulDiv
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
CharLowerA
RegQueryValueExA
SafeArrayGetUBound
VerQueryValueA
DeleteObject
ImageList_GetIconSize
setsockopt
bind
StartSpy
StopSpy
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ