??��?IP
_???������3��D��
Behavioral task
behavioral1
Sample
d33b1e0e364bf7d0693f6ae4b534dc3bba95deb9fed74b929bda8a5d967aed7a.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
d33b1e0e364bf7d0693f6ae4b534dc3bba95deb9fed74b929bda8a5d967aed7a.dll
Resource
win10v2004-20230703-en
Target
d33b1e0e364bf7d0693f6ae4b534dc3bba95deb9fed74b929bda8a5d967aed7a
Size
1.2MB
MD5
89ea890472fae1bdcec86902c7f7aa18
SHA1
0332bc40fd52767f5308cc4f205afb008ceaa2bc
SHA256
d33b1e0e364bf7d0693f6ae4b534dc3bba95deb9fed74b929bda8a5d967aed7a
SHA512
1f445e173fd5dcf89ccba9aab63213b1c53c8e109c73e46a1d1ed61c69f3408a0237a7f795cd5ff59f1a9c980f8ef9fa77c786d457a38453277e77ace5f46e82
SSDEEP
24576:R/XWG0MHmdTt4DKumrosffB4M2drheZYs9DXVK1kIb87GY+44mq4:9XWPMHmdTam0sffBsheZYs9DXVK1kIY+
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
d33b1e0e364bf7d0693f6ae4b534dc3bba95deb9fed74b929bda8a5d967aed7a |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetVersionExA
GetVersion
GetWindowsDirectoryA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
RegOpenKeyA
DrawTextA
SaveDC
SHGetPathFromIDListA
PathFileExistsA
send
RasHangUpA
DocumentPropertiesA
ord17
InternetReadFile
??��?IP
_???������3��D��
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ