CreateImageObject
DestroyImageObject
TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr
Behavioral task
behavioral1
Sample
0ed496a1fd1f160ba3b66adccc64f5e3.dll
Resource
win7-20231129-en
Target
0ed496a1fd1f160ba3b66adccc64f5e3
Size
2.9MB
MD5
0ed496a1fd1f160ba3b66adccc64f5e3
SHA1
fd1c8b51148a9db3f3a92866c3a3d7466fcd1273
SHA256
5f4c14ea0eeab9ad11b5e30db4fc9340fb1f3efcc683a0141bf7bf897a12f503
SHA512
06a9675513f774609b427a1d28f6a78cc2249f810a3597e6c7b260a61654e37fb325accd3cee8bcbe30e56caa860be85609c7e6f9c1a43df88f3ecc922f62313
SSDEEP
49152:gaL9ORzpSKmpzUc+2lvFk0pnkOJh0GSuUvqgJzm9jy3Z3s0qSYPgzOW1Qyy4s4wK:1hO9HNcL9nRkchoq069WzY4zzfyv5cLz
resource | yara_rule |
---|---|
sample | themida |
Checks for missing Authenticode signature.
resource |
---|
0ed496a1fd1f160ba3b66adccc64f5e3 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
CreateImageObject
DestroyImageObject
TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ