DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
XLUserS_CreateXunleiUserInstance
Behavioral task
behavioral1
Sample
c0ae6db6a8e0db7b0c7d161380549fc0.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
c0ae6db6a8e0db7b0c7d161380549fc0.dll
Resource
win10v2004-20230915-en
Target
c0ae6db6a8e0db7b0c7d161380549fc0.bin
Size
1.4MB
MD5
c0ae6db6a8e0db7b0c7d161380549fc0
SHA1
9ef343cdd0f2768e10220c8ff843547bc1eb3c8e
SHA256
bdea64858229772c88c92bfff9d8585554d24164e09b597cc342cd279612da0c
SHA512
0aa20fc7bbafb51f7eb6587f1edf71803264b4cdc0adc3b6b44bf9a35f19c1a5b3a61b0817b128a07ba83fc8b871dd6cbf8c23f609ec0f92f7b893729255b936
SSDEEP
12288:DF0HjI+mJJehyb4alDIwK+t8O9KS95wXwm84dcDmrk5S/P:DFCQeYvlDIdLZ0DBc/
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
c0ae6db6a8e0db7b0c7d161380549fc0.bin |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
closesocket
XLLRT_RegisterGlobalObj
ResetEvent
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
CreateWindowExW
MessageBoxA
CoCreateInstance
SysFreeString
ord32
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
_purecall
DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
XLUserS_CreateXunleiUserInstance
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ