��ʼ��
��ʼ�鶾
�ͷ�����
ѧϰ
Static task
static1
Behavioral task
behavioral1
Sample
c0e40a416a586f35477ba22dc8666a8f2487475b432db17465c6b305b236244f.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
c0e40a416a586f35477ba22dc8666a8f2487475b432db17465c6b305b236244f.dll
Resource
win10v2004-20230220-en
Target
c0e40a416a586f35477ba22dc8666a8f2487475b432db17465c6b305b236244f
Size
263KB
MD5
7a849e83d95199138e41781f50653acf
SHA1
7e6291bb9bdea2661a78ea26fdba0f4a3e92a1a4
SHA256
c0e40a416a586f35477ba22dc8666a8f2487475b432db17465c6b305b236244f
SHA512
389999cf53610d73bdc8b2a5db9c6e1255683bc0179cdeae7e4dbecde4b87cdfb6abef69c4191887b497f05a4f8e88205fee1324cd5747fd89591c0326bdd057
SSDEEP
6144:Rn7oG9xGZvQEyodW5M8yjyJGrJEyvP4TW5/8XBafUabrFi:zIQ1odW5kjHP4TW5/18Er
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
resource | yara_rule |
---|---|
sample | patched_upx |
Checks for missing Authenticode signature.
resource |
---|
c0e40a416a586f35477ba22dc8666a8f2487475b432db17465c6b305b236244f |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
MessageBoxA
FreeLibrary
lstrcatA
GetModuleFileNameA
ExitProcess
LoadLibraryA
GetProcAddress
lstrlenA
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
��ʼ��
��ʼ�鶾
�ͷ�����
ѧϰ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ