Driveinjection
Driverbegin
Forcedeletefile
Getmodule
Keymousemovement
SqNc
Unload_drive
duzhizhen
wiliduzhizhen
wulixiezhizhen
xiezhizhen
Behavioral task
behavioral1
Sample
03135d1e9d6bdfde42b2278d7a61c871fc9f0ec162c0255916c2fccb5e590f37.dll
Resource
win7-20231025-en
Target
03135d1e9d6bdfde42b2278d7a61c871fc9f0ec162c0255916c2fccb5e590f37
Size
73KB
MD5
f20d010fc7952cb17f4289fe8b4962cc
SHA1
2903c6a6e01f1b5e6e67132c58222f8f0fe024f2
SHA256
03135d1e9d6bdfde42b2278d7a61c871fc9f0ec162c0255916c2fccb5e590f37
SHA512
8ed10d6f1cd521be43cf019a187601c31fd41709be295a563cf964837b4c1179a3a71ca4ebfecd91b0df8e5d8aead67b90c5bd292e54ce4e6411f43bd569a437
SSDEEP
1536:Ige8gQP8WMoplkRi+X6SCzTezWdc9ieJkOZhsAHFJHs9jqae9SYskfGnouy8eL:Igrkp5aG0ATwAlZCe9SLkf2outeL
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
03135d1e9d6bdfde42b2278d7a61c871fc9f0ec162c0255916c2fccb5e590f37 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Driveinjection
Driverbegin
Forcedeletefile
Getmodule
Keymousemovement
SqNc
Unload_drive
duzhizhen
wiliduzhizhen
wulixiezhizhen
xiezhizhen
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ