GetCardExist
GetFaceValue
GetStatus
LoadRecharge
ProRecharge
Behavioral task
behavioral1
Sample
客户端/ceshi.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
客户端/ceshi.dll
Resource
win10v2004-20230915-en
Target
629a3469e0f2395af7a28167d0dd22f2ea961991fb2f0b8cc238256b399d2d75
Size
6.9MB
MD5
93a15a9d1697d86501ee8104d427f762
SHA1
a3f63c47071f53ecb1a5dd94e4813c76eebc892c
SHA256
629a3469e0f2395af7a28167d0dd22f2ea961991fb2f0b8cc238256b399d2d75
SHA512
67be08b513d09259c14520b28cc70a646822f8fc4a8bed5bccf0ecde7da2709d4e95c1111bc406ce3a7eb58b894482c4f849ab47c8fba87f1ba11ff8277c220b
SSDEEP
196608:qRvUiuJa94G6cMPe1iRzdGJ0157Pbhk9e6:qRvUAxnMPe1iRoJa5DdV6
resource | yara_rule |
---|---|
static1/unpack001/客户端/ceshi.dll | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
unpack001/客户端/ceshi.dll |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetAdaptersInfo
midiOutUnprepareHeader
htons
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
DefWindowProcA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
SetWindowOrgEx
OpenPrinterA
RegOpenKeyExA
SHGetSpecialFolderPathA
CLSIDFromProgID
SysFreeString
ord17
GetSaveFileNameA
WTSSendMessageW
GetCardExist
GetFaceValue
GetStatus
LoadRecharge
ProRecharge
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ