Init
MapID
_�����ӳ���
Behavioral task
behavioral1
Sample
b9b40ff723ae8bfb5e35aa9bf90531e0567b82493a12959e493b69945ffb11f8.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
b9b40ff723ae8bfb5e35aa9bf90531e0567b82493a12959e493b69945ffb11f8.dll
Resource
win10v2004-20230915-en
Target
b9b40ff723ae8bfb5e35aa9bf90531e0567b82493a12959e493b69945ffb11f8
Size
2.3MB
MD5
ddc90ca04d7b2c36749e42f658a6f8ec
SHA1
cb0aa5878e1167a139f8c501c6c1021d2c2f01d7
SHA256
b9b40ff723ae8bfb5e35aa9bf90531e0567b82493a12959e493b69945ffb11f8
SHA512
c9c5bfbfc8bec9930b910fee8f2363bda253e6653935babf3290182bba0b057af4d456493c62471f58cbefdb3f0d6dd9713ef89d6bd657fa27100638940d6e93
SSDEEP
49152:rVuMxbiTftvExhITHvNehfcLthrBTJRH8Mzf+sKx5/bhfafxGxq2QP:xuM2vEx+T4ktHtRKs8/bm
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
b9b40ff723ae8bfb5e35aa9bf90531e0567b82493a12959e493b69945ffb11f8 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
OpenProcess
ReadProcessMemory
GetLocalTime
CreateToolhelp32Snapshot
Module32First
Module32Next
VirtualQueryEx
WideCharToMultiByte
CreateWaitableTimerA
SetWaitableTimer
WaitForSingleObject
VirtualQuery
GetLastError
GetWindowsDirectoryA
GetSystemDirectoryA
GetModuleHandleA
SetErrorMode
CreateRemoteThread
GetProcessTimes
VirtualProtect
GetProcAddress
HeapReAlloc
HeapFree
IsBadReadPtr
GetModuleFileNameA
GetTickCount
Sleep
GetCommandLineA
FreeLibrary
LCMapStringA
LoadLibraryA
MultiByteToWideChar
SetFilePointer
IsBadCodePtr
SetUnhandledExceptionFilter
WriteFile
CloseHandle
HeapAlloc
GetProcessHeap
RtlMoveMemory
ExitProcess
CreateThread
FlushFileBuffers
SetStdHandle
GetStringTypeW
GetStringTypeA
SetLastError
FlushInstructionCache
GetTempPathA
lstrcpyn
GetCurrentProcess
RtlUnwind
InterlockedDecrement
InterlockedIncrement
TerminateProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
RaiseException
VirtualAlloc
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
LCMapStringW
GetCPInfo
GetACP
GetOEMCP
GetVersionExA
GetVersion
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
MessageBoxA
ExitWindowsEx
SendMessageTimeoutA
CallWindowProcA
MessageBoxTimeoutA
GetForegroundWindow
RegQueryValueExA
RegOpenKeyA
RegCloseKey
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
SystemTimeToVariantTime
VariantTimeToSystemTime
SHGetSpecialFolderPathA
Init
MapID
_�����ӳ���
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE