hextoBin
֪ͨ����
ע��
Behavioral task
behavioral1
Sample
6f73ecdd2fa36504090e99b25f3e57e35881f811bf99117fff106e8d8d3c0c5e.dll
Resource
win7-20230712-en
Target
6f73ecdd2fa36504090e99b25f3e57e35881f811bf99117fff106e8d8d3c0c5e
Size
3.8MB
MD5
147882f0f96ae633b7257d5096419e8b
SHA1
3ef7af59fc6098aeff8e4bc7fcd98b9a62a647d0
SHA256
6f73ecdd2fa36504090e99b25f3e57e35881f811bf99117fff106e8d8d3c0c5e
SHA512
dfe64dbe68bf9e92a013fb047a429ff37123c6d4a76f124abc6794e3f4ea003ef88f5b738d8de7bc50b74e2b504b6b54981cfed15b880d711167333bc9eb8b18
SSDEEP
98304:VYkjHgIjDnaxtWg5qhsh2oPVm0kZTIyuHYDitqlZDsQ7Vc:VYkTOxt5JhfVeZcyKYmUZIYV
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
6f73ecdd2fa36504090e99b25f3e57e35881f811bf99117fff106e8d8d3c0c5e |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
waveOutRestart
WSAStartup
VerQueryValueA
GetVersion
GetVersionExA
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
GetForegroundWindow
CharUpperBuffW
ExtSelectClipRgn
OpenPrinterA
RegQueryValueA
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
ShellExecuteA
OleInitialize
VariantCopyInd
ImageList_Destroy
GetFileTitleA
WTSSendMessageW
hextoBin
֪ͨ����
ע��
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ