SHGetFolderPathA
SHGetFolderPathW
Behavioral task
behavioral1
Sample
c5aaf3da14ec31e094bdc1a5230aabe98920b837e72218a1a8082fa0ea264b44.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
c5aaf3da14ec31e094bdc1a5230aabe98920b837e72218a1a8082fa0ea264b44.dll
Resource
win10v2004-20230915-en
Target
c5aaf3da14ec31e094bdc1a5230aabe98920b837e72218a1a8082fa0ea264b44
Size
205KB
MD5
891171c7b8c2a5b252aa7ce3aae02a26
SHA1
c3156b94001837653f85de23d9c2b1f3d158ac6b
SHA256
c5aaf3da14ec31e094bdc1a5230aabe98920b837e72218a1a8082fa0ea264b44
SHA512
af19a56fc2551536c78f6c440f1d52724eb785f89c1e308b375bd795e8c03319a33399b9b150c87ee5ef0299c010acfa937adb4f9165fdad98ebedaa3dc42624
SSDEEP
6144:7abtuM5ZxQqV7iz271+jWVYEzc1ROGu/:7GtuM5ZxQNA+1u
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
c5aaf3da14ec31e094bdc1a5230aabe98920b837e72218a1a8082fa0ea264b44 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
LoadLibraryExA
lstrcatA
GetSystemDirectoryA
LocalFree
GlobalUnlock
LocalLock
GlobalAlloc
DeviceIoControl
lstrcpyA
CloseHandle
CreateFileA
GetLastError
lstrcpynA
lstrlenA
GetProcAddress
WaitForSingleObject
CreateSemaphoreA
GetTickCount
GetLocalTime
GetModuleHandleA
ExitProcess
LoadLibraryA
VirtualProtect
SetLastError
GetCurrentThread
DisableThreadLibraryCalls
GetCurrentProcessId
QueryPerformanceCounter
RtlCaptureContext
ReleaseSemaphore
FreeLibrary
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
Sleep
GetSystemTimeAsFileTime
VirtualAlloc
SuspendThread
VirtualFree
GetThreadContext
SetThreadContext
GetCurrentProcess
FlushInstructionCache
ResumeThread
GetCurrentThreadId
VirtualQuery
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
MessageBoxA
wsprintfA
RegDeleteKeyA
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_malloc_crt
_initterm
_initterm_e
_encoded_null
_amsg_exit
__CppXcptFilter
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
__crt_debugger_hook
__clean_type_info_names_internal
__C_specific_handler
_wcsicmp
_wcslwr
srand
rand
wcscpy
strcpy
sprintf
wcsstr
_time64
??3@YAXPEAX@Z
memcmp
strlen
malloc
free
memcpy
memset
??2@YAPEAX_K@Z
SHGetFolderPathA
SHGetFolderPathW
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ