Driveinjection
Driverbegin
Forcedeletefile
Getmodule
Keymousemovement
SqNc
Unload_drive
duzhizhen
wulixiezhizhen
xiezhizhen
Behavioral task
behavioral1
Sample
e0206993c4fa59e3ea11bb00b24bb9820315dfb7d737ee083524481490bf9ef1.dll
Resource
win7-20230831-en
Target
e0206993c4fa59e3ea11bb00b24bb9820315dfb7d737ee083524481490bf9ef1
Size
73KB
MD5
b746c9ae89ce518fa1b13a7837eb4245
SHA1
f006277253e54077e8cb450586a162f1a2930535
SHA256
e0206993c4fa59e3ea11bb00b24bb9820315dfb7d737ee083524481490bf9ef1
SHA512
7091ed6d62cb6b49cc1676646fa8af2909c67d2b89f26bb9c1cee410aa819a4a753c92396f8340bb3ecbc94298a0f063e1ffe499a2111508dd878b9e7bca2c4f
SSDEEP
1536:ZmfmYnq6d73BIeTWk0Vz0qEebrBmliQQPIHHwCe4DoppQCUfnouy8I:Umf6pRIaWku3rBmu+wCcpoPoutI
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
e0206993c4fa59e3ea11bb00b24bb9820315dfb7d737ee083524481490bf9ef1 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Driveinjection
Driverbegin
Forcedeletefile
Getmodule
Keymousemovement
SqNc
Unload_drive
duzhizhen
wulixiezhizhen
xiezhizhen
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ