@@Inreg@Finalize
@@Inreg@Initialize
@@Showtry@Finalize
@@Showtry@Initialize
@System@TObject@ClassNameIs$qqrx17System@AnsiString
@System@TObject@ClassNameIs$qqrx17System@AnsiString
GetRegister
ShowTryWindow
_Reg_Form
_Try_Form
___CPPdebugHook
Behavioral task
behavioral1
Sample
NEAS.be9e3fa6085c39c5a4665a582a6e96e0_JC.dll
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.be9e3fa6085c39c5a4665a582a6e96e0_JC.dll
Resource
win10v2004-20231023-en
Target
NEAS.be9e3fa6085c39c5a4665a582a6e96e0_JC.exe
Size
210KB
MD5
be9e3fa6085c39c5a4665a582a6e96e0
SHA1
80cdc2fc0b1a24550d58476f63103a610bd39e1e
SHA256
e3ef4cf23d074d04a4339d40d3dbbe19b32b0c53df61a260cedd55e6783140c3
SHA512
ad526b24526fc4ebcacf88be7cb57482405bb820bd1dd6d14c37795b071aa94bf56b25050cc78be52f1623adcef824c62abdb4d82410e12fe5bc2c8615b96f62
SSDEEP
3072:G0vpX+RB4p3ToQG6Rz3zj3ynV4jmZVy2xfVFaZPA1xMhtMJZH:GhTcR13zYSmZNf7ckMhu
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
NEAS.be9e3fa6085c39c5a4665a582a6e96e0_JC.exe |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
@@Inreg@Finalize
@@Inreg@Initialize
@@Showtry@Finalize
@@Showtry@Initialize
@System@TObject@ClassNameIs$qqrx17System@AnsiString
@System@TObject@ClassNameIs$qqrx17System@AnsiString
GetRegister
ShowTryWindow
_Reg_Form
_Try_Form
___CPPdebugHook
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE