scanCook
scanbegin
Behavioral task
behavioral1
Sample
646d6064ef6db65508e1f1e177c55220.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
646d6064ef6db65508e1f1e177c55220.dll
Resource
win10v2004-20231215-en
Target
646d6064ef6db65508e1f1e177c55220
Size
468KB
MD5
646d6064ef6db65508e1f1e177c55220
SHA1
d0939c1ee74c67ecf287b9be6719085315ddf817
SHA256
1a1fff1592d04efa05727d167d8960d8e03ff1bf9ab0f8aecc43743f3aeee8c9
SHA512
d853a4f56ccdc6a52d99a53d4568ff6f07274de6b3223e834ccc79ec82f90dfb32d59061638c5f707b4653a7bc1e09605c5c549bd921301ee03709d8bc8c0246
SSDEEP
12288:lUqqDcx0sl9K+SGd3JjKeJmQLPGS7ypk6rpC:GnK3l4XK5eejLuS+yOC
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
646d6064ef6db65508e1f1e177c55220 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CreateProcessW
GetModuleHandleA
GetProcAddress
VirtualProtect
?uncaught_exception@std@@YA_NXZ
?what@exception@std@@UBEPBDXZ
WSAAsyncSelect
CoCreateInstance
SetTimer
OpenProcessToken
GetModuleFileNameExA
scanCook
scanbegin
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ