Hookoff
Hookon
InstallService
KsCreateAllocator
KsCreateClock
KsCreatePin
KsCreateTopologyNode
Behavioral task
behavioral1
Sample
56e6fa17d175dac68fb81b9e3a01863a.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
56e6fa17d175dac68fb81b9e3a01863a.dll
Resource
win10v2004-20231222-en
Target
56e6fa17d175dac68fb81b9e3a01863a
Size
12KB
MD5
56e6fa17d175dac68fb81b9e3a01863a
SHA1
482ff21394fcef046dd2c7c67e92bfe7af1de55a
SHA256
73f150bec54b786dc22304fd49ab5d3b981350a4edadf33938c7cf574684b344
SHA512
76f3a01dc27703d7ea48dcf2a0c50e7227018124c9b3c38830cdd2968a19a7b8922ac631be70512d057ac0104e0081f243290ca6fa53fab2a2c8b81fd6f17e31
SSDEEP
192:TsvQqQLVXh8gaFLKlcMsDBe4dGTLlPG4pdAaTXdjjBxXp4eh6JhU89zvE4:TsvaVmzFLNDDBe9TLlb7Xdjjrns+8tv
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
56e6fa17d175dac68fb81b9e3a01863a |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Hookoff
Hookon
InstallService
KsCreateAllocator
KsCreateClock
KsCreatePin
KsCreateTopologyNode
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ