??��?IP
_???������3��D��
Behavioral task
behavioral1
Sample
fedd7f20ed2aa66a07f408a4e7c86412347e69d444a0d04a7527618ca7d35957.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
fedd7f20ed2aa66a07f408a4e7c86412347e69d444a0d04a7527618ca7d35957.dll
Resource
win10v2004-20230220-en
Target
fedd7f20ed2aa66a07f408a4e7c86412347e69d444a0d04a7527618ca7d35957
Size
1.2MB
MD5
cd73d961d824232ddac74fad98510c9b
SHA1
950850ffd24d113d979aa17d119d2abab09581db
SHA256
fedd7f20ed2aa66a07f408a4e7c86412347e69d444a0d04a7527618ca7d35957
SHA512
e5a5f60a3fa57aa4748ed864b688341d7bf309e0480cec8b6c15c33da3e8d41dcb15044282962c9f502f9cc6261f81ebfc2306cf310a16c8dc0ce3094133026d
SSDEEP
24576:HeIIsvpC/SIhUe1Sezj/MgEiIKdkEa63xY+U333r80mLIv+e7y:HXIsxC6IOQdrkshYB333r80v9
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
fedd7f20ed2aa66a07f408a4e7c86412347e69d444a0d04a7527618ca7d35957 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
GetVersionExA
GetVersion
CreateToolhelp32Snapshot
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
OpenProcessToken
SystemParametersInfoA
PtVisible
SHGetPathFromIDListA
PathFileExistsA
WSACleanup
RasHangUpA
OpenPrinterA
ord17
InternetCrackUrlA
??��?IP
_???������3��D��
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ