Init
MapID
_�����ӳ���
Behavioral task
behavioral1
Sample
b145da3f62e10221953f79797eb649e19fc6b54c5d1262f87ca2d4849f9acb9b.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
b145da3f62e10221953f79797eb649e19fc6b54c5d1262f87ca2d4849f9acb9b.dll
Resource
win10v2004-20230831-en
Target
b145da3f62e10221953f79797eb649e19fc6b54c5d1262f87ca2d4849f9acb9b
Size
1.0MB
MD5
f8807079a266c57668d2824bad295669
SHA1
d2486b79329cbc227ac56938cd3c846db9191cfb
SHA256
b145da3f62e10221953f79797eb649e19fc6b54c5d1262f87ca2d4849f9acb9b
SHA512
733f5c46dd8590659037f52191ae4a2b0eadbe3b9f33d3fa2cc638f11da06e6786a3c42c5cf762ee2590db4b7907b33f47f47de5ee33502ed4b008378093ab0f
SSDEEP
24576:2hrtNZTJRulMjC/4Oa8Mzei+IjKxmM/bhwCHafxGxq2QJBdx:2hrBTJRH8Mzf+sKx5/bhfafxGxq2QP
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
b145da3f62e10221953f79797eb649e19fc6b54c5d1262f87ca2d4849f9acb9b |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetVersionExA
GetVersion
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
PeekMessageA
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
GetFileVersionInfoA
SystemTimeToVariantTime
SHGetSpecialFolderPathA
Init
MapID
_�����ӳ���
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ