Driveinjection
Driverbegin
Forcedeletefile
Getmodule
Keymousemovement
SqNc
Unload_drive
duzhizhen
wulixiezhizhen
xiezhizhen
Behavioral task
behavioral1
Sample
9cebfbea6e322ad03004d1231e836206934b0bfe6f58184e49a6cc31547487a2.dll
Resource
win7-20230831-en
Target
9cebfbea6e322ad03004d1231e836206934b0bfe6f58184e49a6cc31547487a2
Size
73KB
MD5
e9bfbe6ea7e2eacb6f8732bbd9331bd4
SHA1
92aee45123de0299140502842f30e9903743a45e
SHA256
9cebfbea6e322ad03004d1231e836206934b0bfe6f58184e49a6cc31547487a2
SHA512
adddf69137845deff41c5a639e503fcaaafe5be18cd2ec34d7855fb7506df44b67826a71f912b4cf5f91d72cc3ab064bb4de7fee67afbbc45e9944eaaaae83fc
SSDEEP
1536:LmfmYnq6detLja03+bu0SnQQPJBa/9koMumO3sDJAFWPvTDwjqatLnouy8/:2mf6U+036+P29koMwwAQvTEDtTout/
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
9cebfbea6e322ad03004d1231e836206934b0bfe6f58184e49a6cc31547487a2 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Driveinjection
Driverbegin
Forcedeletefile
Getmodule
Keymousemovement
SqNc
Unload_drive
duzhizhen
wulixiezhizhen
xiezhizhen
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ