Driveinjection
Driverbegin
Forcedeletefile
Getmodule
Keymousemovement
SqNc
Unload_drive
duzhizhen
wiliduzhizhen
wulixiezhizhen
xiezhizhen
xuniyingjian
Behavioral task
behavioral1
Sample
5297ea7b43a12c7e21f7445efbcda59b4e64c4e66422eac052fda48382d8eddb.dll
Resource
win7-20240215-en
Target
5297ea7b43a12c7e21f7445efbcda59b4e64c4e66422eac052fda48382d8eddb
Size
74KB
MD5
0000dde7c0014dfde9b1bd54d9ef14fe
SHA1
4c7ea9b565c23be3f24b0ebf99316c2f1900ff23
SHA256
5297ea7b43a12c7e21f7445efbcda59b4e64c4e66422eac052fda48382d8eddb
SHA512
80941a279ed29214c6a0d2ab0d594d874979a5d40a39180be5d5f416f649c4fa2b687a62c9ac98e9f534c4eac9b94022fe8fd0056c6ae8c8d2b428537683fe68
SSDEEP
1536:HClQbIyxSswdoLEmh97VqcQbsJ1yz8zcRH9EG94nV3g45CJQ6AWzLdhBYnouy8Y:iab3PxImhQcW8zchpeV3gMCJQ6AWzLyO
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
5297ea7b43a12c7e21f7445efbcda59b4e64c4e66422eac052fda48382d8eddb |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Driveinjection
Driverbegin
Forcedeletefile
Getmodule
Keymousemovement
SqNc
Unload_drive
duzhizhen
wiliduzhizhen
wulixiezhizhen
xiezhizhen
xuniyingjian
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ