hextoBin
֪ͨ����
ע��
Behavioral task
behavioral1
Sample
3d35db2361509e7e6494e936845c2ae0e5b9042f5282d30f38b84a9e52f2e861.dll
Resource
win7-20230831-en
Target
3d35db2361509e7e6494e936845c2ae0e5b9042f5282d30f38b84a9e52f2e861
Size
3.8MB
MD5
59a617a409d5c800f96aa064db9faca4
SHA1
9bb4056f7e8694031a96fbb73435bba51156c1a2
SHA256
3d35db2361509e7e6494e936845c2ae0e5b9042f5282d30f38b84a9e52f2e861
SHA512
6c34ac107c492bab5a62668a467a4587e491aecbbe1d85b7a08e3b04424bc352d086f5a1a96768dcd01af3e9638a5df1a45706782f0c6ebe39b5dfbad8bb0be4
SSDEEP
98304:iC3yMLvSa0gBpuyFzCjk9gkPKV/sTIwBzW9feYK0CessEe:HyM7L0ep/9gOKV7Y0K0Cy9
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
3d35db2361509e7e6494e936845c2ae0e5b9042f5282d30f38b84a9e52f2e861 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
waveOutRestart
WSAStartup
VerQueryValueA
GetVersion
GetVersionExA
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
GetForegroundWindow
CharUpperBuffW
ExtSelectClipRgn
OpenPrinterA
RegQueryValueA
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
ShellExecuteA
OleInitialize
VariantCopyInd
ImageList_Destroy
GetFileTitleA
WTSSendMessageW
hextoBin
֪ͨ����
ע��
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ