WumingD
WumingE
Behavioral task
behavioral1
Sample
5479b29b7b86fe99ffe9cfb42ee36528726e5107d1cb929c6164196424d336de.dll
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
5479b29b7b86fe99ffe9cfb42ee36528726e5107d1cb929c6164196424d336de.dll
Resource
win10v2004-20230621-en
Target
5479b29b7b86fe99ffe9cfb42ee36528726e5107d1cb929c6164196424d336de
Size
642KB
MD5
e02578e14e1c80ffa87700feb9e9da8d
SHA1
9dce3d9f8a1bb804589a9ea7f6876cd0496bf6e4
SHA256
5479b29b7b86fe99ffe9cfb42ee36528726e5107d1cb929c6164196424d336de
SHA512
35f685aea8d34ca158e14c0795a388219d059e4ec74515fd7d8057b4c0e41686bf8d764e06fe710a6300f247ecccebd3d5600f3208e3f9d8e74fd8a76bcf636a
SSDEEP
12288:M9CXPVkx/DPtLs2bCRIM2GMBh4haigl1j4zCYhclUCxh:MUe9DNbbCCMJO4h/EGslUCxh
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
5479b29b7b86fe99ffe9cfb42ee36528726e5107d1cb929c6164196424d336de |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
GetProcAddress
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
GetWindowLongA
GetStockObject
GetOpenFileNameA
RegOpenKeyExA
CreateStreamOnHGlobal
OleLoadPicture
StrStrIA
ord17
timeGetTime
GetModuleInformation
WumingD
WumingE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ