Driveinjection
Driverbegin
Forcedeletefile
Getmodule
Keymousemovement
SqNc
Unload_drive
duzhizhen
wulixiezhizhen
xiezhizhen
Behavioral task
behavioral1
Sample
8b7e87b0ca2ccac7c2c63f18835d72607a3f3e8367dfb0ff664050b649d2b570.dll
Resource
win7-20230831-en
Target
8b7e87b0ca2ccac7c2c63f18835d72607a3f3e8367dfb0ff664050b649d2b570
Size
73KB
MD5
f2a20100c77aa7a1c052c6a01c2c338f
SHA1
ebb740dd7c833fcfaedda4d266dc13e6810ba4cc
SHA256
8b7e87b0ca2ccac7c2c63f18835d72607a3f3e8367dfb0ff664050b649d2b570
SHA512
a33d3285b0bda8153815389df1b5df5d6ca49192edbaf4be2322fa5b30f8b2aeee02c1159728df5a12365dab2388ba2c9ebc8c7d777df08f04ad76496c2dd18b
SSDEEP
1536:ZmfmYnq6d7yL+6qYwuQtSoII4lcstCRp2je72TMulEQ6nouy8I:Umf6lyL+6hwtRII4lcswRpODioutI
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
8b7e87b0ca2ccac7c2c63f18835d72607a3f3e8367dfb0ff664050b649d2b570 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Driveinjection
Driverbegin
Forcedeletefile
Getmodule
Keymousemovement
SqNc
Unload_drive
duzhizhen
wulixiezhizhen
xiezhizhen
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ