hextoBin
֪ͨ����
ע��
Behavioral task
behavioral1
Sample
722d115994e3768095a8c173445504e2b50579516615ecdf68769d5ed836afa2.dll
Resource
win7-20230831-en
Target
722d115994e3768095a8c173445504e2b50579516615ecdf68769d5ed836afa2
Size
3.8MB
MD5
5ebf5e8d158b876e16c85b47c1b151bf
SHA1
e06da7a041c1fd0436606e9b2d3c3963c72249ec
SHA256
722d115994e3768095a8c173445504e2b50579516615ecdf68769d5ed836afa2
SHA512
66dedb7c058cd55946a467ffce855e2f074406bf406098f350f9a822d5c9d5ad4f48e29d8ad0daf8df1be348bb63cda5d78020e4185cf66a5f4ad45ac1d6c1dc
SSDEEP
98304:iC3yMLvSa0gBpuyFzCjk9gkPKV/sTIwBzW9feYK0CessET:HyM7L0ep/9gOKV7Y0K0Cys
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
722d115994e3768095a8c173445504e2b50579516615ecdf68769d5ed836afa2 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
waveOutRestart
WSAStartup
VerQueryValueA
GetVersion
GetVersionExA
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
GetForegroundWindow
CharUpperBuffW
ExtSelectClipRgn
OpenPrinterA
RegQueryValueA
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
ShellExecuteA
OleInitialize
VariantCopyInd
ImageList_Destroy
GetFileTitleA
WTSSendMessageW
hextoBin
֪ͨ����
ע��
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ