hextoBin
֪ͨ����
ע��
Behavioral task
behavioral1
Sample
c44b72567bc8ba2dca6799f5f2db212bcc6da429c7437104d40d3739f0eb8d37.dll
Resource
win7-20230712-en
Target
c44b72567bc8ba2dca6799f5f2db212bcc6da429c7437104d40d3739f0eb8d37
Size
3.9MB
MD5
eddb72a82bc7508b97c359358469b646
SHA1
b4ad468285975f044ec01aee0eb047bf81bc25a1
SHA256
c44b72567bc8ba2dca6799f5f2db212bcc6da429c7437104d40d3739f0eb8d37
SHA512
ff50189ed2491440e46968625903a8294b608446a05a70cb7e755e7d697bef3987ebede6141cb2563b3f8e27f7c6eb84510f12d428364a959b4c1ca1bc3aabf2
SSDEEP
98304:uAhV9bxwBRrx4IRisdC0OzkhxIk3hQ7VH8fjat:d9dwtqaBdCLkT3kE0
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
c44b72567bc8ba2dca6799f5f2db212bcc6da429c7437104d40d3739f0eb8d37 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
waveOutRestart
WSAStartup
VerQueryValueA
GetVersion
GetVersionExA
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
GetForegroundWindow
CharUpperBuffW
ExtSelectClipRgn
OpenPrinterA
RegQueryValueA
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
ShellExecuteA
OleInitialize
VariantCopyInd
ImageList_Destroy
GetFileTitleA
WTSSendMessageW
hextoBin
֪ͨ����
ע��
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ