??��?IP
_???������3��D��
Behavioral task
behavioral1
Sample
69918aa06d93d107fa1fb84bd76bee03ce4704e6f5ca23baf56df41c1dd11a37.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
69918aa06d93d107fa1fb84bd76bee03ce4704e6f5ca23baf56df41c1dd11a37.dll
Resource
win10v2004-20230915-en
Target
69918aa06d93d107fa1fb84bd76bee03ce4704e6f5ca23baf56df41c1dd11a37
Size
1.2MB
MD5
4daaaae79d557cb136032d0653b1daac
SHA1
7595f1888576b917036075e9632a6acfdb5080a9
SHA256
69918aa06d93d107fa1fb84bd76bee03ce4704e6f5ca23baf56df41c1dd11a37
SHA512
dddbcaacc21bd442f5ab64dedae87237dc1173929fba820b0ccd363d0f84a2511fe5b9489603d73a5d313af2bbfcbdac4c679fcc0e435bf92090708ac83cdd70
SSDEEP
24576:s4lehsXSy/pMlWvbMK1ixnKGKhMuPtoarOEyMm5ghmqYUQP:rcETRMluMMiJKGKeuPjOEyMmGXxQP
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
69918aa06d93d107fa1fb84bd76bee03ce4704e6f5ca23baf56df41c1dd11a37 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetVersionExA
GetVersion
IsProcessorFeaturePresent
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
RegOpenKeyA
IsWindowEnabled
CreateBitmap
SHGetSpecialFolderPathA
PathFileExistsA
gethostbyname
RasHangUpA
DocumentPropertiesA
ord17
InternetOpenA
??��?IP
_???������3��D��
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ