hextoBin
֪ͨ����
ע��
Behavioral task
behavioral1
Sample
a26acac9a422d3e69970d8a87f6e307ca87d0d11a76ff2f907707dde379efc1e.dll
Resource
win7-20230712-en
Target
a26acac9a422d3e69970d8a87f6e307ca87d0d11a76ff2f907707dde379efc1e
Size
3.8MB
MD5
f1568fbc16967e6dba95b0067a1e54fa
SHA1
0c315bc8825e6f1b5472305de7de2c9145db636e
SHA256
a26acac9a422d3e69970d8a87f6e307ca87d0d11a76ff2f907707dde379efc1e
SHA512
8adaba00c2c0ff51ee5ccf20324025556be1ce8015ea5e9f31dafdb04afba3f1bfe4a3e3cf6dcb3ea079b77142ca4d9a623710e9a7de213e1a72bb8b4cb230a0
SSDEEP
98304:E1dbgYdI8+GPEqRv/Lqy73ctzbFXM4FATHuVBt3:GdtEqtz3zchiHux
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
a26acac9a422d3e69970d8a87f6e307ca87d0d11a76ff2f907707dde379efc1e |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
waveOutRestart
WSAStartup
VerQueryValueA
GetVersion
GetVersionExA
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
GetForegroundWindow
CharUpperBuffW
ExtSelectClipRgn
OpenPrinterA
RegQueryValueA
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
ShellExecuteA
OleInitialize
VariantCopyInd
ImageList_Destroy
GetFileTitleA
WTSSendMessageW
hextoBin
֪ͨ����
ע��
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ