Hook
UnHook
Behavioral task
behavioral1
Sample
44395cca9c8afecf410a7849e9a829bb.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
44395cca9c8afecf410a7849e9a829bb.dll
Resource
win10v2004-20231222-en
Target
44395cca9c8afecf410a7849e9a829bb
Size
388KB
MD5
44395cca9c8afecf410a7849e9a829bb
SHA1
182c281d93c6fcdd6514a5fc0325af9f7142e0de
SHA256
53a3309a2476e225c8735e7c8d78cc3995469c2d9ca88a23672b80ce69839054
SHA512
d55df7d375e86f79456888042cf5a15cb85056b6b1f287f37abf70dd1a467698c56590ce0a5a36acd44fb0e4cd343979e140683737c58d442b39166b6448b581
SSDEEP
12288:bJwEwyzZp1Oq0UsNc2D3Qm/OzxvyFO44O5eG1xXG:bJwRi0DNc2D3Qm/Oz1a14IeGrW
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
44395cca9c8afecf410a7849e9a829bb |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
malloc
RtlFillMemory
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
SetEntriesInAclA
ord42
CoInternetSetFeatureEnabled
IsWindow
timeKillEvent
NtQuerySystemInformation
StrStrIA
Hook
UnHook
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ