Init
Run
Set
Uninit
Behavioral task
behavioral1
Sample
d917a43f6399b0f7775a135053fc3bec08028dce6335e5a9c1bbd5445fcbba4e.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
d917a43f6399b0f7775a135053fc3bec08028dce6335e5a9c1bbd5445fcbba4e.dll
Resource
win10v2004-20231222-en
Target
d917a43f6399b0f7775a135053fc3bec08028dce6335e5a9c1bbd5445fcbba4e
Size
3.7MB
MD5
666d7361a1416290c6a68fa9aa9efbd6
SHA1
3fdd9c9c21de757f2310ee400aa3ab4cac3271e0
SHA256
d917a43f6399b0f7775a135053fc3bec08028dce6335e5a9c1bbd5445fcbba4e
SHA512
d356a2197f8d1f28b23366ccb6899cdf9cb967c16da11717c49a26f1f57e8038418d10505524904554af43a7dd2fd2c98385cd8ec48f95f2cc7c9023509b5b0b
SSDEEP
98304:ILgj9HMSzkIankCRznPImrRsRUknaEzG/1WI2rhbPlS:IA+NVRDPImrRz2k/IRrhBS
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
d917a43f6399b0f7775a135053fc3bec08028dce6335e5a9c1bbd5445fcbba4e |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetVersionExW
CreatePipe
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
wsprintfW
RegQueryValueExA
SHGetSpecialFolderPathA
CoInitialize
CertCloseStore
PathFileExistsW
Init
Run
Set
Uninit
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ