??0CPl@@QAE@XZ
??4CPl@@QAEAAV0@ABV0@@Z
?InstallH@@YAHDDHH@Z
?fnMlangl@@YAHXZ
?init@@YAHXZ
?nMlangl@@3HA
Behavioral task
behavioral1
Sample
2942da978ae5bbdfa3b17e5e8cd76a7d.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2942da978ae5bbdfa3b17e5e8cd76a7d.dll
Resource
win10v2004-20231215-en
Target
2942da978ae5bbdfa3b17e5e8cd76a7d
Size
96KB
MD5
2942da978ae5bbdfa3b17e5e8cd76a7d
SHA1
6ef69c97f52ed67f115f55503c00ffb49572a834
SHA256
9fbded5b5c53c18d6feef856b309183b3d73f9bd0c9bdb14afcb683e70caaccc
SHA512
f87bcd1353ea699677a2b8909309ccd27a09892c5d2e7758168c50621cb42d6e66699a225a33085033945cb3d41cdb2fff738d187a195192357035b12d92ee22
SSDEEP
1536:2O8gK8TaL0dacuToZB+SLkE9PoamhrS/duMo8+kXKyOw7SIW5nRz209DzEgocL9s:2IRaLojYS7m5S/duVk7OvRhggtLC
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
2942da978ae5bbdfa3b17e5e8cd76a7d |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
VirtualProtectEx
GetCurrentProcess
GetCurrentProcessId
GetProcAddress
LoadLibraryA
GetModuleFileNameA
GetModuleHandleA
CloseHandle
GetLastError
CreateMutexA
GetStringTypeW
GetStringTypeA
LCMapStringW
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
MultiByteToWideChar
LCMapStringA
RtlUnwind
FindWindowA
??0CPl@@QAE@XZ
??4CPl@@QAEAAV0@ABV0@@Z
?InstallH@@YAHDDHH@Z
?fnMlangl@@YAHXZ
?init@@YAHXZ
?nMlangl@@3HA
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ