??��?IP
_???������3��D��
Behavioral task
behavioral1
Sample
2452decdf35fe29397d2c0655dff134a20be0870e05a86f7152c5b261cdb2510.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2452decdf35fe29397d2c0655dff134a20be0870e05a86f7152c5b261cdb2510.dll
Resource
win10v2004-20230220-en
Target
2452decdf35fe29397d2c0655dff134a20be0870e05a86f7152c5b261cdb2510
Size
1.2MB
MD5
d87a344518972c8d03ed0b4693af02ee
SHA1
b3f846b743bf31193d47f86ef5dcd353280f52c7
SHA256
2452decdf35fe29397d2c0655dff134a20be0870e05a86f7152c5b261cdb2510
SHA512
8d24404b2df95a802f4c074c1f207982bce3abdc438bf21b28fb2dc6ef1691a9d6da2961a5694bcc337106921ba7c1bcb52884ded9c8e7956dd88a1b765e6c9d
SSDEEP
24576:KUoNYmpQOiQIYQT5rFtrkVAum84ZGB4AVAEbkpXOlZANW7CsCTZb4OdxNT9:ONYGkdFMApHEBXmEbk9iyNWmsCFb4OJB
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
2452decdf35fe29397d2c0655dff134a20be0870e05a86f7152c5b261cdb2510 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
GetVersionExA
GetVersion
GlobalReAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
RegQueryValueExA
TranslateMessage
SetViewportOrgEx
SHGetPathFromIDListA
PathFileExistsA
ntohs
RasHangUpA
OpenPrinterA
ord17
InternetCrackUrlA
??��?IP
_???������3��D��
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ