??��?IP
_???������3��D��
Behavioral task
behavioral1
Sample
bc8de8742ef09afaad38e59bbcc9ee8ee9522fcd050a3783f9c135c4f96a5963.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
bc8de8742ef09afaad38e59bbcc9ee8ee9522fcd050a3783f9c135c4f96a5963.dll
Resource
win10v2004-20230915-en
Target
bc8de8742ef09afaad38e59bbcc9ee8ee9522fcd050a3783f9c135c4f96a5963
Size
1.2MB
MD5
a05845d29b14a674559a40d0aa4839f6
SHA1
e0216c439b8c7b83d56e6edff99b1ef4e02d2e22
SHA256
bc8de8742ef09afaad38e59bbcc9ee8ee9522fcd050a3783f9c135c4f96a5963
SHA512
53e9168f4885c7c66fb87a51e4f90cc4a85aecd67caf82ea8e38208a2e9de29a47ccd5a67bce0497a9ed9c2a01d1b82e40c6c8cbb0e7fef0f70e163179197de3
SSDEEP
24576:qL6RqHLPk2K9NJp4Jirx2LKV3fRe/3czBCJjxaaKzaP6/3:qKqWJp4SrdMfczBkMZzv/3
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
bc8de8742ef09afaad38e59bbcc9ee8ee9522fcd050a3783f9c135c4f96a5963 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetVersionExA
GetVersion
GlobalHandle
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
LookupPrivilegeValueA
DrawTextA
RestoreDC
ShellExecuteA
PathFileExistsA
connect
RasHangUpA
DocumentPropertiesA
ord17
InternetOpenA
??��?IP
_???������3��D��
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ