hextoBin
֪ͨ����
ע��
Behavioral task
behavioral1
Sample
26565c7294c80fadb9cd5f9dcb51d9cd92de1fefb08544fc5f873bcc97a57cd4.dll
Resource
win7-20230831-en
Target
26565c7294c80fadb9cd5f9dcb51d9cd92de1fefb08544fc5f873bcc97a57cd4
Size
3.8MB
MD5
50a86f1bec2b3f71b4dba6874863f397
SHA1
a8bc57c7219bcebe4706751a8aab98ceb3bf8d9d
SHA256
26565c7294c80fadb9cd5f9dcb51d9cd92de1fefb08544fc5f873bcc97a57cd4
SHA512
18b82de75a01deb095a8d9adf391fddff00ea477164aef052a9c1c726af8dd235665d3e88c519b79883aeea58db9a6c8aadccb00416ecf2d307c9379a89f55f0
SSDEEP
98304:FWud4FFY0b8nu6tHZ8XKMsUefOSfeY6Yy4FPuK:Qud4zgaefhfeY6Yy4FPd
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
26565c7294c80fadb9cd5f9dcb51d9cd92de1fefb08544fc5f873bcc97a57cd4 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
waveOutRestart
WSAStartup
VerQueryValueA
GetVersion
GetVersionExA
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
GetForegroundWindow
CharUpperBuffW
ExtSelectClipRgn
OpenPrinterA
RegQueryValueA
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
ShellExecuteA
OleInitialize
VariantCopyInd
ImageList_Destroy
GetFileTitleA
WTSSendMessageW
hextoBin
֪ͨ����
ע��
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ