?������CALL
RunDllHostCallBack
Behavioral task
behavioral1
Sample
2e433b9dcb1899694c6da8dd62f57664.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2e433b9dcb1899694c6da8dd62f57664.dll
Resource
win10v2004-20231215-en
Target
2e433b9dcb1899694c6da8dd62f57664
Size
864KB
MD5
2e433b9dcb1899694c6da8dd62f57664
SHA1
a79aeae841714ef5f688f3ebe4a6c0d3ff64dc5e
SHA256
e68abc38fe82aff29eea3b4b30c1ae7b6385a920055ee02bc3c902f5917ad07c
SHA512
b31a894a3ab22489bcf86ef94dacd804abe9dc6440a7fab51d0656034349425cd9a65cce2ffda918ee3021503e9f4a42d1d1384a62324311263ee3d232cdb71f
SSDEEP
24576:5PKywVKQAcJMAKr+YHfbRW92FNX+PUwQTm:5CXK2KrtbROaX+Pw
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
2e433b9dcb1899694c6da8dd62f57664 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
waveOutOpen
closesocket
GetFileType
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
TranslateAcceleratorA
GetObjectA
OpenPrinterA
RegCreateKeyExA
Shell_NotifyIconA
OleUninitialize
LoadTypeLi
ord17
GetSaveFileNameA
?������CALL
RunDllHostCallBack
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ