??��?IP
_???������3��D��
Behavioral task
behavioral1
Sample
2ee62d139956b682fdb0b8190cb90fb1018f59b9473ac31f372062d1d9e71d78.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2ee62d139956b682fdb0b8190cb90fb1018f59b9473ac31f372062d1d9e71d78.dll
Resource
win10v2004-20230220-en
Target
2ee62d139956b682fdb0b8190cb90fb1018f59b9473ac31f372062d1d9e71d78
Size
1.2MB
MD5
cb60c6b1745c0b658e8a998bdff351d7
SHA1
81fc062bda9a2b82846fc91d2340234b865cb021
SHA256
2ee62d139956b682fdb0b8190cb90fb1018f59b9473ac31f372062d1d9e71d78
SHA512
9b16451ed31a37e11fece05b5b5d92a090897826d8df6c4c1b3209ad1477ff74c429a67e6802aa6b6edaf91aa3bacfe5a6ee780d476c1f00241e5c4e129b506c
SSDEEP
24576:kmVvVZXfsuJQUcExB4XS6HddZ3hmJxIbEDUjRv75:/7ConcgC0JxIjRT5
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
2ee62d139956b682fdb0b8190cb90fb1018f59b9473ac31f372062d1d9e71d78 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
GetVersionExA
GetVersion
WaitNamedPipeA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
AdjustTokenPrivileges
GetAsyncKeyState
RectVisible
SHGetSpecialFolderLocation
PathFileExistsA
closesocket
RasHangUpA
DocumentPropertiesA
ord17
InternetCrackUrlA
??��?IP
_???������3��D��
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ