hextoBin
֪ͨ����
ע��
Behavioral task
behavioral1
Sample
31ae3c7d3da347991d4fdccd9f233bbcdf99a2963f8f98c8af58f205a7e6c9dc.dll
Resource
win7-20230831-en
Target
31ae3c7d3da347991d4fdccd9f233bbcdf99a2963f8f98c8af58f205a7e6c9dc
Size
3.9MB
MD5
82d63b6ef8ad1f9cc0929c66feefc82b
SHA1
803efe63d1a766372df56b23748e912f5dff547c
SHA256
31ae3c7d3da347991d4fdccd9f233bbcdf99a2963f8f98c8af58f205a7e6c9dc
SHA512
db43acabb233577d7aabbb8d1ecf16a0c1ee5ab2048c8dd6b312fd86435c8301d07641e5ca9ae15e89a458b9ffe540b32a15b6d6cb9eb989458f6883051fc798
SSDEEP
98304:uAhV9bxwBRrx4IRisdC0OzkhxIk3hQ7VH8fja/:d9dwtqaBdCLkT3kE+
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
31ae3c7d3da347991d4fdccd9f233bbcdf99a2963f8f98c8af58f205a7e6c9dc |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
waveOutRestart
WSAStartup
VerQueryValueA
GetVersion
GetVersionExA
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
GetForegroundWindow
CharUpperBuffW
ExtSelectClipRgn
OpenPrinterA
RegQueryValueA
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
ShellExecuteA
OleInitialize
VariantCopyInd
ImageList_Destroy
GetFileTitleA
WTSSendMessageW
hextoBin
֪ͨ����
ע��
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ