??��?IP
_???������3��D��
Behavioral task
behavioral1
Sample
464e7fa49373b8f2380867acf4d14cd66bd2fd19dd80b002a819f26c8ec48b9f.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
464e7fa49373b8f2380867acf4d14cd66bd2fd19dd80b002a819f26c8ec48b9f.dll
Resource
win10v2004-20230220-en
Target
464e7fa49373b8f2380867acf4d14cd66bd2fd19dd80b002a819f26c8ec48b9f
Size
1.2MB
MD5
340196233165c247d62b9681cd069866
SHA1
7d0621ebc0bee3db7763a98237519bd2f9a9309d
SHA256
464e7fa49373b8f2380867acf4d14cd66bd2fd19dd80b002a819f26c8ec48b9f
SHA512
b347138552675604222e1b70843af67d4535ad44d0cf8ade5e3d2c6fa9812858452fad3f16ca96fd4dd4eec759041a552ebc72ebd1230e2d2eb372c898e5cde2
SSDEEP
24576:D/YQnEdxNx08oS52KbksaAsxfS8gjuBQ3G8+EGEFoaNn+b6Rt:sUEFe8nzQxfaKBQ2cGEFoap+b6R
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
464e7fa49373b8f2380867acf4d14cd66bd2fd19dd80b002a819f26c8ec48b9f |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
GetVersionExA
GetVersion
GetLastError
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
AdjustTokenPrivileges
GetNextDlgTabItem
ScaleViewportExtEx
SHGetPathFromIDListA
PathFileExistsA
setsockopt
RasGetConnectStatusA
OpenPrinterA
ord17
InternetReadFile
??��?IP
_???������3��D��
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ