DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
JmpHookOff
JmpHookOn
Behavioral task
behavioral1
Sample
434be7a50f316146e086818898f490d2.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
434be7a50f316146e086818898f490d2.dll
Resource
win10v2004-20231215-en
Target
434be7a50f316146e086818898f490d2
Size
30KB
MD5
434be7a50f316146e086818898f490d2
SHA1
6b9317fc61035e0537c1a1262b98118ed0ad3970
SHA256
db751efcedd0eaa7f029f61590488e4a4b82a1b812a946cbd9db08f3655fb970
SHA512
353b3eb10894faf74f60c6f30311db3dc0015df70caa4d1722c7448c0c76c09d06174a91f3f9f7aed28428ae0374d3edefc61bd0fb74f04f262738784c99b1f2
SSDEEP
768:uKSAquOm0GQomKmnGuoEEAAkYQ26nYve+FrEE5/:qAquOm0GQomKcjNlLYmYm7E5/
resource | yara_rule |
---|---|
sample | modiloader_stage2 |
Checks for missing Authenticode signature.
resource |
---|
434be7a50f316146e086818898f490d2 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
JmpHookOff
JmpHookOn
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ