??��?IP
_???������3��D��
Behavioral task
behavioral1
Sample
61d0c2fc467c2289bed9ebd0352971fccd2e6ffd04020e2cde505e1ffee53e3c.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
61d0c2fc467c2289bed9ebd0352971fccd2e6ffd04020e2cde505e1ffee53e3c.dll
Resource
win10v2004-20230220-en
Target
61d0c2fc467c2289bed9ebd0352971fccd2e6ffd04020e2cde505e1ffee53e3c
Size
1.2MB
MD5
d4edac78bfd83dc7a580fba8ced1402c
SHA1
d7e7ddc7c29e7f55844faf051bae1e4d77613cd9
SHA256
61d0c2fc467c2289bed9ebd0352971fccd2e6ffd04020e2cde505e1ffee53e3c
SHA512
2d477b2b0032b4dbc3ebcc52512e14e33ec578c27a7fdc36f2e407e700b6da47dd2366ad72b2a55765ef9e8bd9f68f6f715c0c69b15bba2865b6b1b70ea76e0b
SSDEEP
24576:AX4MS9lBRJcz80v6xQSPr65ja/GnmbNznsc3K864qjXoBL07dORW:k4MS9jRJcpv6SSTjZzsj4mQIYs
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
61d0c2fc467c2289bed9ebd0352971fccd2e6ffd04020e2cde505e1ffee53e3c |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
GetVersionExA
GetVersion
ReadFile
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
RegSetValueExA
SetFocus
CreateBitmap
SHGetPathFromIDListA
PathFileExistsA
connect
RasHangUpA
OpenPrinterA
ord17
HttpOpenRequestA
??��?IP
_???������3��D��
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ