Driveinjection
Driverbegin
Forcedeletefile
Getmodule
Keymousemovement
SqNc
Unload_drive
duzhizhen
wiliduzhizhen
wulixiezhizhen
xiezhizhen
Behavioral task
behavioral1
Sample
0052f3bfb344f8bf4ac63615af193e5aa80fa859096ad4fdb6e1c3edc72e5735.dll
Resource
win7-20231020-en
Target
0052f3bfb344f8bf4ac63615af193e5aa80fa859096ad4fdb6e1c3edc72e5735
Size
73KB
MD5
cfe4f41767ab444d5dcd082022d39add
SHA1
76a6143eaf73b2fe1111747d45d0596756450b8a
SHA256
0052f3bfb344f8bf4ac63615af193e5aa80fa859096ad4fdb6e1c3edc72e5735
SHA512
ba7d1511333ec3a2759f8d20b8ed1ac34e01b5f3286ca853b2e16f578a323bb4cf3ae68a429b26cf8e85b85ce44e8d400b22446cb3dc7ade41d49e7b056ff6f6
SSDEEP
1536:Y2WshnNq4txJtoJMlp+xv6DS/vJjRu1/6fiBeqiQOXDmGWTVjCnouy8P:ld7x/o2DKJjS4iBeqSXyhpjaoutP
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
0052f3bfb344f8bf4ac63615af193e5aa80fa859096ad4fdb6e1c3edc72e5735 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Driveinjection
Driverbegin
Forcedeletefile
Getmodule
Keymousemovement
SqNc
Unload_drive
duzhizhen
wiliduzhizhen
wulixiezhizhen
xiezhizhen
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ