ServiceMain
install
Behavioral task
behavioral1
Sample
80490d459f8b63b049a07220a1bcccf9.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
80490d459f8b63b049a07220a1bcccf9.dll
Resource
win10v2004-20231215-en
Target
80490d459f8b63b049a07220a1bcccf9
Size
321KB
MD5
80490d459f8b63b049a07220a1bcccf9
SHA1
9e821023cd4c9534ad2c51cb23bfd4b0d9746e65
SHA256
e873fe7fecf07b18f406da0a76bda506ec7912b3c7bcdafb4e234f8c0dcf278d
SHA512
082336db35c43042de2735ba4c5ca0bff8e6fac9f4ad90a4ce9a73c19af19563a93ffad5598a420907062392cc2d0d41db0d10ae2004cb5c244427232075ae90
SSDEEP
6144:PLg8k1IIdOsbasxhNOYNO8oOB4QAp1h8E/yVr/AR1euTnmTnv:PLWOpsgYo8oOB4Q2n8MyBA6u0
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
80490d459f8b63b049a07220a1bcccf9 |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
bind
recv
WSACleanup
shutdown
connect
WSASetLastError
__WSAFDIsSet
WSAGetLastError
WSAIoctl
sendto
recvfrom
ioctlsocket
socket
getprotobyname
getservbyname
getpeername
getaddrinfo
select
htons
getsockname
setsockopt
getsockopt
getnameinfo
accept
htonl
freeaddrinfo
send
closesocket
listen
ntohl
ntohs
gethostname
WSAStartup
inet_addr
gethostbyname
GetAdaptersInfo
SendARP
OpenServiceA
CloseServiceHandle
OpenSCManagerW
CreateServiceA
CryptCreateHash
CryptHashData
CryptGetHashParam
QueryServiceStatus
RegEnumKeyW
CryptDestroyHash
CryptAcquireContextA
CryptImportKey
RegSetValueExA
RegisterServiceCtrlHandlerA
RegQueryValueExA
RegCreateKeyExA
SetServiceStatus
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
CryptDestroyKey
CryptEncrypt
CryptReleaseContext
RegOpenKeyExA
StartServiceW
CloseHandle
InterlockedCompareExchange
SwitchToThread
CreateThread
CreateFileA
GetFileSize
MapViewOfFile
UnmapViewOfFile
InterlockedIncrement
InterlockedDecrement
GetTickCount
ReadFile
GetShortPathNameA
GetProcAddress
CreateFileMappingA
GetTempPathA
SetEvent
SleepEx
WaitForSingleObjectEx
InitializeCriticalSection
CreateEventA
LeaveCriticalSection
CreateSemaphoreA
ReleaseSemaphore
EnterCriticalSection
DeviceIoControl
DeleteCriticalSection
OutputDebugStringA
FormatMessageA
GetVersion
FindClose
FreeLibrary
InterlockedExchange
CreateMutexW
QueryPerformanceCounter
GlobalLock
WaitForSingleObject
GetModuleHandleW
WriteFile
GlobalAlloc
GetSystemDirectoryW
WideCharToMultiByte
LoadLibraryW
MultiByteToWideChar
GlobalUnlock
SetLastError
GlobalFree
GlobalHandle
ReleaseMutex
VerifyVersionInfoA
VerSetConditionMask
PeekNamedPipe
WaitForMultipleObjects
GetFileType
GetStdHandle
LoadLibraryA
ExpandEnvironmentStringsA
HeapFree
HeapAlloc
HeapReAlloc
DecodePointer
GetSystemTimeAsFileTime
GetTimeZoneInformation
GetCurrentThreadId
GetCommandLineA
RtlUnwind
GetLastError
InitializeCriticalSectionAndSpinCount
ExitProcess
ExitThread
GetCurrentProcessId
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileInformationByHandle
SetFilePointer
GetDriveTypeA
FindFirstFileExA
RaiseException
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
HeapCreate
HeapDestroy
GetModuleFileNameW
SetHandleCount
GetStartupInfoW
IsProcessorFeaturePresent
GetConsoleCP
GetConsoleMode
FlushFileBuffers
HeapSize
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
LCMapStringW
GetFullPathNameA
GetCurrentDirectoryW
GetStringTypeW
WriteConsoleW
CompareStringW
SetEnvironmentVariableA
GetDriveTypeW
SetEndOfFile
GetProcessHeap
CreateFileW
GetCurrentProcess
Sleep
EncodePointer
CreateEventW
SetStdHandle
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
ServiceMain
install
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ