?GetCode@@YA_NHPAD_N@Z
?GetPP@@YA_NPAD@Z
Behavioral task
behavioral1
Sample
2b21b140a2e6c869653754972c89d178df2348f60cae58c0154df8d5294b9461.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
2b21b140a2e6c869653754972c89d178df2348f60cae58c0154df8d5294b9461.dll
Resource
win10v2004-20230703-en
Target
2b21b140a2e6c869653754972c89d178df2348f60cae58c0154df8d5294b9461
Size
5.9MB
MD5
9e87f24f3c121935df238059c65b4bce
SHA1
7a249db0ffb44a97fdc2137692c3c4f6967fd245
SHA256
2b21b140a2e6c869653754972c89d178df2348f60cae58c0154df8d5294b9461
SHA512
32aac03e9924ada81c194c545e15beac5db7af0fa4e36fb82a900c5ef3b6d6f898a05c98c68f61785a6e697277e27c12d7d1ac2d8cc2fdc6fc273f5592b6915f
SSDEEP
98304:zbIqdJF6NtxdbLzGeZhoJy0siVnAX1NUfF+giZLBo8tom0gZuM6cBOhnl:zbpT6NfdbLaAhiXBnAXDgcgS+8tcKVVu
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
2b21b140a2e6c869653754972c89d178df2348f60cae58c0154df8d5294b9461 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetVersionExA
GetVersion
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
EndPaint
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
DeleteDC
GetFileTitleW
DocumentPropertiesW
RegSetValueExW
PathFindExtensionW
SysAllocStringLen
SymFunctionTableAccess
GetAdaptersInfo
gethostname
WTSSendMessageW
?GetCode@@YA_NHPAD_N@Z
?GetPP@@YA_NPAD@Z
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ