UnHook
WSPStartup
installhook
Behavioral task
behavioral1
Sample
6477cd76bf75c8982a2284809f55bdf2.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
6477cd76bf75c8982a2284809f55bdf2.dll
Resource
win10v2004-20231215-en
Target
6477cd76bf75c8982a2284809f55bdf2
Size
136KB
MD5
6477cd76bf75c8982a2284809f55bdf2
SHA1
c02d215afce80f2a2ad5878c3bebe32758248ff7
SHA256
c90ec4e07b656a8daae85fa440e62059172e366a8d9853c8d89404254b1d9aaa
SHA512
baf26d016ea0580a6f4da7ec63a404442dd2a9ec4b588e1a48225d72613d8b636beec8e55ce377e469f5daa11fdd6b7e0f7b4de94fe22bd7117d27db2a5c5451
SSDEEP
3072:zwmIrWuVQjgk8T6WNIRFfOYkKtgsTbJy5X5J:Ebqity1kQTbJ05J
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
6477cd76bf75c8982a2284809f55bdf2 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
LoadLibraryA
GetProcAddress
ExitProcess
UnHook
WSPStartup
installhook
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ