??��?IP
_???������3��D��
Behavioral task
behavioral1
Sample
fcebbd30fdbe15075523a9ef02632ed038896cecc963f2eeee0ad09e152157e4.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
fcebbd30fdbe15075523a9ef02632ed038896cecc963f2eeee0ad09e152157e4.dll
Resource
win10v2004-20230915-en
Target
fcebbd30fdbe15075523a9ef02632ed038896cecc963f2eeee0ad09e152157e4
Size
1.2MB
MD5
13a2e33ae6da5b67399efdf8f3eb6244
SHA1
b4de7ab715e8c7a5329e2494ef40c2e3ec59e1a0
SHA256
fcebbd30fdbe15075523a9ef02632ed038896cecc963f2eeee0ad09e152157e4
SHA512
7853b4e986441af85219272f79d0a317ec79d842727228de17b6636671866b94c14a4b92ee6847625e9174c4862b808ff1822c00257f94a42b1f0e5f41689f9f
SSDEEP
24576:7ef/rqrn+VzgTUAwDZ4/aqbq2rLMABPusQB:Ceozg4ziSyqYPusQ
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
fcebbd30fdbe15075523a9ef02632ed038896cecc963f2eeee0ad09e152157e4 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetVersionExA
GetVersion
HeapFree
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
RegOpenKeyExA
GrayStringA
GetObjectA
SHGetPathFromIDListA
PathFileExistsA
shutdown
RasHangUpA
ClosePrinter
ord17
HttpOpenRequestA
??��?IP
_???������3��D��
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ