DllProcedureOverLoad
GetDLLDesc
IsPEMS5DLL
SetDllApplication
Behavioral task
behavioral1
Sample
df8e8d2b8c80492da80237195083ad9e7ec344faff980687062fb4d6a17c8188.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
df8e8d2b8c80492da80237195083ad9e7ec344faff980687062fb4d6a17c8188.dll
Resource
win10v2004-20230220-en
Target
df8e8d2b8c80492da80237195083ad9e7ec344faff980687062fb4d6a17c8188
Size
658KB
MD5
1e464ecdeab9dfbf5da81012154d4199
SHA1
0c87c08ba7703162d084c7b2dc6eddd1b620dc3c
SHA256
df8e8d2b8c80492da80237195083ad9e7ec344faff980687062fb4d6a17c8188
SHA512
ee770a2a71656a599747472092bd6836c6029274c66167846d06aacfd0dbc29c668bc4a00bb0b51a66f4ecdddf048445234a4bfea90fe8cfa677fd9013850d38
SSDEEP
12288:7Nby5uo6aB59IWvmeP7nrrcYmVrXaVFTNoS8K/5:JXo6aBHLvmAnncYmVrqdoSx5
Processes:
resource | yara_rule |
---|---|
sample | aspack_v212_v242 |
Checks for missing Authenticode signature.
Processes:
resource |
---|
df8e8d2b8c80492da80237195083ad9e7ec344faff980687062fb4d6a17c8188 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
DllProcedureOverLoad
GetDLLDesc
IsPEMS5DLL
SetDllApplication
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE