@@Csocket@Finalize
@@Csocket@Initialize
@@Ffrmbot@Finalize
@@Ffrmbot@Initialize
@@Ffrmlogin@Finalize
@@Ffrmlogin@Initialize
@@Main@Finalize
@@Main@Initialize
___CPPdebugHook
_dlgAddition
_dlgCZ
_dlgParty
_frmBot
_frmLogin
Behavioral task
behavioral1
Sample
4868dbd7a037a51bf95fd27f1f69768c.dll
Resource
win7-20231215-en
Target
4868dbd7a037a51bf95fd27f1f69768c
Size
1.5MB
MD5
4868dbd7a037a51bf95fd27f1f69768c
SHA1
178d78dd9175c8024d0179f235d80bb93ad44d88
SHA256
e9b49356b70fc707f65211ab2fb367e0d0bbaccad57132b4b94b2d24ab495393
SHA512
38cc189f76691ae145110c0e3757c14ad3782ca87c2056f18a5c101721e2c9b2d1b168bd6ba42e44679531f5a5dcd15b4d51abe71e3d69bfc4c0995b6eba64d0
SSDEEP
24576:xQ25kXAJ2eVSfSH3C9qtIaIRvtvF/kd4eMODxvk01VMDFOXssw67WpPoR:+Xs2CRH3C9qtNI5td/c/uOyuWm
resource | yara_rule |
---|---|
sample | themida |
Checks for missing Authenticode signature.
resource |
---|
4868dbd7a037a51bf95fd27f1f69768c |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
@@Csocket@Finalize
@@Csocket@Initialize
@@Ffrmbot@Finalize
@@Ffrmbot@Initialize
@@Ffrmlogin@Finalize
@@Ffrmlogin@Initialize
@@Main@Finalize
@@Main@Initialize
___CPPdebugHook
_dlgAddition
_dlgCZ
_dlgParty
_frmBot
_frmLogin
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE