Driveinjection
Driverbegin
Forcedeletefile
Getmodule
Keymousemovement
SqNc
Unload_drive
duzhizhen
wiliduzhizhen
wulixiezhizhen
xiezhizhen
xuniyingjian
Behavioral task
behavioral1
Sample
b46ba60350e6e8720710ee27af2c4df91fee9b5ace0dcc3d4072a83eb3153b2c.dll
Resource
win7-20231020-en
Target
b46ba60350e6e8720710ee27af2c4df91fee9b5ace0dcc3d4072a83eb3153b2c
Size
88KB
MD5
279e1e56ddf930f4e9c73b82cb114c5b
SHA1
436d297671c66379a903bae76d018b25683b5a43
SHA256
b46ba60350e6e8720710ee27af2c4df91fee9b5ace0dcc3d4072a83eb3153b2c
SHA512
ccb428fbe58d8de792555e9f8e72f86564dffd986ac411ad7fe56c255df6b4bb23557a5544daffeae0729546f0789ae21a441f8d12e48b94f059e2bad42777b7
SSDEEP
1536:vQ8ilCUQ6YiXwgtvv6dljNTzjfJ/JM/Ux9C9JBlufRusMCGoy6zi+QcP8YUunouU:IZiWoX/jfFJvaTBkE5n4i+HPWuoutqT9
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
b46ba60350e6e8720710ee27af2c4df91fee9b5ace0dcc3d4072a83eb3153b2c |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Driveinjection
Driverbegin
Forcedeletefile
Getmodule
Keymousemovement
SqNc
Unload_drive
duzhizhen
wiliduzhizhen
wulixiezhizhen
xiezhizhen
xuniyingjian
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ