UnHook
WSPStartup
installhook
Behavioral task
behavioral1
Sample
7b523af51172d75f2a7c6722d23e875d.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7b523af51172d75f2a7c6722d23e875d.dll
Resource
win10v2004-20231222-en
Target
7b523af51172d75f2a7c6722d23e875d
Size
120KB
MD5
7b523af51172d75f2a7c6722d23e875d
SHA1
74ca7c4be7d839a0349ae843322af1fe8bfccf26
SHA256
8c9b5077bae6d37a115757be5440be0c089b7dcea96deb37745c0c4e1f0f3f06
SHA512
adac9810ca3634061ca15c66ca5bd1c1765ca3f803c68bd78d1f88c54153706d4a287501b43054848b6fc6c0afa74c85f9f382fde126c775f16f0ba03c1c17d1
SSDEEP
1536:OEthCXZHPWWWDXvKW7x13AIP0xzFqwJFzmNobGEFQDvZeNpi2vgfrN5dGLXtdo:OEfCJvWFXvl7xFqFqCCSSEmBeLOyrM
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
7b523af51172d75f2a7c6722d23e875d |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
LoadLibraryA
GetProcAddress
ExitProcess
UnHook
WSPStartup
installhook
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ