DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
JmpHookOff
JmpHookOn
Behavioral task
behavioral1
Sample
NEAS.e83148e2b3dff278c12f49ed29d91280.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.e83148e2b3dff278c12f49ed29d91280.dll
Resource
win10v2004-20230915-en
Target
NEAS.e83148e2b3dff278c12f49ed29d91280.exe
Size
274KB
MD5
e83148e2b3dff278c12f49ed29d91280
SHA1
569a783bc1e3f96fafd8887513faaf85f7421fd3
SHA256
1f6b50213d657d00f8450e28ec3b67ec96f674e19b33877ecb9404bb423c34b7
SHA512
61167bf562d490c6d36f428804eb3825ce14e6e6947b837d9910dea7f5f859c349140455a9722f5f7ac056da9d053af5cda0059d8a6491d5215ce77b1b5557ca
SSDEEP
3072:tKDUz+Qwd32B3xpXbOBONl3IV9j3b3O47Pt3LEsf2Cp2GivcxwPnzEx6bs:ADUzjy8xpOBONl3IVVXtbFfv3gzEx6bs
resource | yara_rule |
---|---|
sample | modiloader_stage2 |
Checks for missing Authenticode signature.
resource |
---|
NEAS.e83148e2b3dff278c12f49ed29d91280.exe |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
JmpHookOff
JmpHookOn
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE