DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
NSGetModule
RD_XXXX
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.Malware-gen.1665.10087.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Win32.Malware-gen.1665.10087.dll
Resource
win10v2004-20231215-en
Target
SecuriteInfo.com.Win32.Malware-gen.1665.10087.dll
Size
2.0MB
MD5
8a7d70eb9f40c74111993d5018b85ee3
SHA1
7fa097fb6ae7b25ca21b0200b668f89eadc52391
SHA256
e793e811ed02dea2e88038d2dec27201f2754f6f9e3b21aeb3878acf8037fbbf
SHA512
acba3d906c0ba074ef1a23434985f26dfd0568897bb47c15b2a6044ddab8d356b98b15fb21f49fbb4298ce6ec9cd581eb60652b300a4ebed450c57c782426f42
SSDEEP
24576:O6l9c4ly6I8obGV4UyDQtbXL7Pf9jgqFORKCdzRw//ejunoKCSghZfGu:Oc5lUXYrL7PFnsR/hK3qKPCS0v
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
SecuriteInfo.com.Win32.Malware-gen.1665.10087.dll |
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DisableThreadLibraryCalls
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
IsWindow
MessageBoxA
OpenProcessToken
SHGetSpecialFolderPathW
CoInitialize
UnRegisterTypeLi
ord61
PathAppendW
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
ord7
swprintf_s
PP_URLYYY
UuidFromStringA
GetFileVersionInfoSizeW
InternetWriteFile
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
NSGetModule
RD_XXXX
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ