DoMainWork
DoService
ServiceMain
Behavioral task
behavioral1
Sample
71bf2955cb9a1c9cb5ac892e126721b4.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
71bf2955cb9a1c9cb5ac892e126721b4.dll
Resource
win10v2004-20231215-en
Target
71bf2955cb9a1c9cb5ac892e126721b4
Size
194KB
MD5
71bf2955cb9a1c9cb5ac892e126721b4
SHA1
5dfdb1782257e6e5547edaad7a38fbe6096e03b4
SHA256
11fe14f890b797641018f4da188b8e968f10aa229552f2b55249b5e5d96a1fe0
SHA512
14ae2735da70f96d3df1d9114dd869014f0708b77554d14faf4b0966dd6184b89249df4396a7a46a4aa1e561f2999eef057ba04ac8f2c373658139f015dcc4bb
SSDEEP
3072:QzHLhdLEHuFReyfpctmhAz9dX3rq66Pfwtzl6+EMS8Q5JNufy+9cLnDXO4:QzrZJ2t9douzlqMS8AJcfyHj
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
71bf2955cb9a1c9cb5ac892e126721b4 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
ExitWindowsEx
DeleteObject
RegCloseKey
ShellExecuteA
CreateStreamOnHGlobal
listen
StrCmpW
GetModuleFileNameExA
ImmReleaseContext
capCreateCaptureWindowA
waveInUnprepareHeader
malloc
lstrcatW
GetModuleHandleA
GetProcAddress
VirtualProtect
DoMainWork
DoService
ServiceMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ