_ʱ��4_�����¼�
Behavioral task
behavioral1
Sample
7369e9b20c9e596d4f7a77cda827bb2a.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
7369e9b20c9e596d4f7a77cda827bb2a.dll
Resource
win10v2004-20231215-en
General
-
Target
7369e9b20c9e596d4f7a77cda827bb2a
-
Size
1.4MB
-
MD5
7369e9b20c9e596d4f7a77cda827bb2a
-
SHA1
72ccc3b2851710a86712f89befa8e4e9db731f59
-
SHA256
6db8ff826a136683139e8e43e8650bd2bb7316e098e6654d83d315c92f79182d
-
SHA512
fd375ceb15fb8dec0fc25a94d343c730ece77572e7415c19d2ffe636172ac09bb45aab757f77611f77f3984e53f877732383791eead0864904795e59f5eeff19
-
SSDEEP
24576:S5r+CMrIHFnftOuH5kq303jAcmDKKSqqDiZAIX6zRx/kxpnczdKXZ21jw7p1uIN:S5TVOuHR303jAcm+XqqDieBz7/kgzdYe
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7369e9b20c9e596d4f7a77cda827bb2a
Files
-
7369e9b20c9e596d4f7a77cda827bb2a.dll windows:4 windows x86 arch:x86
c734c5f5e4bc8b817efdc116119ecdd2
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GlobalUnlock
GetModuleHandleA
GetProcAddress
VirtualProtect
user32
OpenClipboard
gdi32
CreateRectRgnIndirect
winmm
waveOutReset
winspool.drv
ClosePrinter
advapi32
RegQueryValueA
shell32
Shell_NotifyIconA
ole32
OleUninitialize
oleaut32
UnRegisterTypeLi
comctl32
ImageList_Destroy
ws2_32
ioctlsocket
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 494KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 950KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 133KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 66KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: - Virtual size: 130KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ