3��??��y_��?��??��
????_��????��??
????_��?��?��?����
RegisterTdxFunc
��??�¡�?QKL
��??��_��?3��??��y
Behavioral task
behavioral1
Sample
14aefc3430bf1b50ad72539ce407c6e66a59729a3183c46e8aa3c8e7787e81a3.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
14aefc3430bf1b50ad72539ce407c6e66a59729a3183c46e8aa3c8e7787e81a3.dll
Resource
win10v2004-20230915-en
Target
14aefc3430bf1b50ad72539ce407c6e66a59729a3183c46e8aa3c8e7787e81a3
Size
1.2MB
MD5
fe9e38f73a289aa6cb5f1e1286952dd1
SHA1
e708564e30d36224ba9b8ba4eb0ef3643a85d540
SHA256
14aefc3430bf1b50ad72539ce407c6e66a59729a3183c46e8aa3c8e7787e81a3
SHA512
c39effe783f9673dfebabf70166de8785986263136fac4ef755fb770fc91cf08e9aaac0e94b96b700273acd0215f1bac8eed9f28b57affad749836ac16116050
SSDEEP
24576:lBdlU3CcZsjWmmOSYGi9HIvlMoLSY6S9MH4rhThpf6MrnIkey2JL:lhU30SROVGiyvCoLSY60ThpyMLWy2
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
14aefc3430bf1b50ad72539ce407c6e66a59729a3183c46e8aa3c8e7787e81a3 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
midiOutUnprepareHeader
recvfrom
VerLanguageNameA
RasGetConnectStatusA
InitializeCriticalSection
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
SetWindowsHookExA
MoveToEx
ClosePrinter
RegQueryValueExA
ShellExecuteA
CLSIDFromString
UnRegisterTypeLi
ord17
InternetCloseHandle
GetOpenFileNameA
3��??��y_��?��??��
????_��????��??
????_��?��?��?����
RegisterTdxFunc
��??�¡�?QKL
��??��_��?3��??��y
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ