Begin
InstallHook
MainMonitor
init
init_FXRun
init_FXSetup
init_KWRun
init_KWSetup
init_PPRun
init_PPSetup
init_ZMRun
init_ZMSetup
Behavioral task
behavioral1
Sample
35575557bd3a809a4567c1fc51848357.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
35575557bd3a809a4567c1fc51848357.dll
Resource
win10v2004-20231215-en
Target
35575557bd3a809a4567c1fc51848357
Size
64KB
MD5
35575557bd3a809a4567c1fc51848357
SHA1
d4d2ddc7e875766d54329b8deac83ff99c57bd56
SHA256
7d0ed2d621158a3c9bcb8e0ff8320a757bbd76f112edf043588c38445ce25580
SHA512
d6d0debba3b303df633e4e0d81fdf2d5108609786e0c5965512f513c47dc321e34df2e808f12cfb780853e9a7e9ad9bd213b1854d5420e495289f1e94ee20866
SSDEEP
1536:RpU7X3/RNVBNLDbv3suXMFEhj/4XCDPPoqfO0oW8:A5NVzLcuXMFYj/4XmPPoJ0oW8
| resource | yara_rule |
|---|---|
| sample | vmprotect |
Checks for missing Authenticode signature.
| resource |
|---|
| 35575557bd3a809a4567c1fc51848357 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CreateProcessW
CloseHandle
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetCurrentProcess
CreateRemoteThread
GetModuleHandleW
VirtualAllocEx
WritePrivateProfileStringW
MoveFileW
GetPrivateProfileIntW
GetPrivateProfileStringW
DeleteFileW
FindClose
SetFileAttributesW
FindFirstFileW
GetFileSize
CreateFileW
ResumeThread
MultiByteToWideChar
WideCharToMultiByte
GetExitCodeThread
ExitThread
GetSystemTime
ReadFile
SetFilePointer
GetCommandLineW
OpenProcess
FlushFileBuffers
GetStringTypeW
GetStringTypeA
RtlUnwind
SetStdHandle
LoadLibraryA
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
LCMapStringA
HeapReAlloc
VirtualAlloc
WriteFile
VirtualFree
HeapCreate
HeapDestroy
VirtualProtectEx
WriteProcessMemory
Sleep
LoadLibraryW
GetProcAddress
GetCurrentProcessId
GetSystemDirectoryW
TerminateProcess
GetEnvironmentStringsW
GetEnvironmentStrings
InterlockedDecrement
InterlockedIncrement
GetCommandLineA
GetVersion
HeapFree
HeapAlloc
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
GetModuleHandleA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
VirtualProtect
GetWindowThreadProcessId
GetSystemMetrics
ShowWindow
GetClassNameW
GetWindowLongW
GetWindowTextW
DestroyWindow
FindWindowW
GetDlgItem
PostMessageW
GetParent
SetForegroundWindow
SetCapture
SendMessageW
EnumChildWindows
EnumWindows
WaitForInputIdle
MoveWindow
gethostname
gethostbyname
WSAStartup
URLDownloadToFileW
Netbios
waveOutGetVolume
waveOutSetVolume
OpenProcessToken
RegDeleteKeyW
RegEnumValueW
RegCreateKeyW
RegOpenKeyExW
RegSetValueExW
LookupPrivilegeValueW
AdjustTokenPrivileges
SHGetSpecialFolderPathW
Begin
InstallHook
MainMonitor
init
init_FXRun
init_FXSetup
init_KWRun
init_KWSetup
init_PPRun
init_PPSetup
init_ZMRun
init_ZMSetup
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ