BR_Send
BR_SetSvrAckHandler
BR_SetSvrIP
BR_UserInit
Behavioral task
behavioral1
Sample
c446fe7d1b5db7024f77db6abe156ac7944de63ea8983dab3406c59faef8161e.dll
Resource
win7-20231129-en
Target
c446fe7d1b5db7024f77db6abe156ac7944de63ea8983dab3406c59faef8161e.exe
Size
424KB
MD5
4908a4e15dc1418414d6803e4d843ca0
SHA1
b65b223a2e2c790026e801599a7f6afc535f59a3
SHA256
c446fe7d1b5db7024f77db6abe156ac7944de63ea8983dab3406c59faef8161e
SHA512
44f889ff2347de4195645a6deab88fbd0d29a75106da8752c1b93af456dfaf0fcc447cf48f89f1b434ffd45de873038251c1b3b9c44329ab0179b2fbfe79a42b
SSDEEP
12288:1+bGmuGNO1VhkkQlxlWfodrYu3HBbIKu9:1+bGgNO1VRuPWfodr3hbIKu9
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
c446fe7d1b5db7024f77db6abe156ac7944de63ea8983dab3406c59faef8161e.exe |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetProcessHeap
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
Sleep
GetModuleFileNameA
CreateDirectoryA
WriteFile
CreateFileA
MultiByteToWideChar
WideCharToMultiByte
GetUserDefaultLCID
GetCurrentProcessId
ReadFile
GetFileSize
WTSGetActiveConsoleSessionId
GetCommandLineA
FreeLibrary
LoadLibraryA
LCMapStringA
GetLastError
RtlZeroMemory
SetWaitableTimer
CreateWaitableTimerA
lstrcpyn
GetProcAddress
GetModuleHandleA
Process32Next
CloseHandle
Process32First
FlushFileBuffers
SetStdHandle
IsBadCodePtr
SetUnhandledExceptionFilter
GetStringTypeW
DeleteFileA
CreateToolhelp32Snapshot
HeapDestroy
GetEnvironmentVariableA
HeapCreate
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
DeleteCriticalSection
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
TlsGetValue
SetLastError
TlsFree
TlsAlloc
TlsSetValue
GetCurrentThreadId
TerminateProcess
InterlockedIncrement
InterlockedDecrement
RtlUnwind
GetVersion
GetCurrentProcess
GetStringTypeA
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
SetFilePointer
RaiseException
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
IsBadWritePtr
VirtualAlloc
VirtualFree
GetTempPathA
GetSystemDirectoryA
GetWindowsDirectoryA
GetVersionExA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
wsprintfA
DispatchMessageA
MessageBoxA
MsgWaitForMultipleObjects
PeekMessageA
GetMessageA
TranslateMessage
GetFileTitleA
CreateProcessAsUserA
AdjustTokenPrivileges
SetTokenInformation
DuplicateTokenEx
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
CoUninitialize
CoInitialize
CLSIDFromString
CLSIDFromProgID
CoCreateInstance
OleRun
VariantInit
SafeArrayAllocDescriptor
SafeArrayAllocData
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElemsize
SysFreeString
VarR8FromCy
VarR8FromBool
VariantChangeType
LoadTypeLi
LHashValOfNameSys
RegisterTypeLi
VariantCopy
SafeArrayCreate
VariantClear
SafeArrayDestroy
SysAllocString
HttpOpenRequestA
InternetSetOptionA
InternetConnectA
InternetReadFile
HttpQueryInfoA
HttpSendRequestA
InternetCloseHandle
InternetOpenA
PathFileExistsA
WTSQueryUserToken
CreateEnvironmentBlock
SHGetSpecialFolderPathA
BR_Send
BR_SetSvrAckHandler
BR_SetSvrIP
BR_UserInit
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ