BR_Send
BR_SetSvrAckHandler
BR_SetSvrIP
BR_UserInit
Behavioral task
behavioral1
Sample
2c5e6cadc1e9cfb8b460283c5ce08554c86d8fd9a3908b1394930ffbdb79d0fc.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2c5e6cadc1e9cfb8b460283c5ce08554c86d8fd9a3908b1394930ffbdb79d0fc.dll
Resource
win10v2004-20231215-en
Target
2c5e6cadc1e9cfb8b460283c5ce08554c86d8fd9a3908b1394930ffbdb79d0fc
Size
552KB
MD5
7181983a7a9887f32ba166400cef5fea
SHA1
a63b129b5235210ca1c9fc735aef6751682f2558
SHA256
2c5e6cadc1e9cfb8b460283c5ce08554c86d8fd9a3908b1394930ffbdb79d0fc
SHA512
82efb1a6ea2221b3e7b7419d5938b4533d553e788bdbc426f51c2830c29bf872bf18b96294d8bf569110d055a915798235a9bb101e134570babdb63a523cde7f
SSDEEP
12288:H4rXCUdWWu/+7PxpvKIVX2ovMb9Zs7Mlodh8KTk:UmAPxpvKcXtvS7lWSK
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
2c5e6cadc1e9cfb8b460283c5ce08554c86d8fd9a3908b1394930ffbdb79d0fc |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
MultiByteToWideChar
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
TranslateMessage
GetFileTitleA
SetTokenInformation
CoCreateInstance
LHashValOfNameSys
InternetSetOptionA
PathFileExistsA
WTSQueryUserToken
CreateEnvironmentBlock
strncmp
SHGetSpecialFolderPathA
BR_Send
BR_SetSvrAckHandler
BR_SetSvrIP
BR_UserInit
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ