?��1?
RunDllHostCallBack
��??����?1��?��
������?
����?��
Behavioral task
behavioral1
Sample
c3a631f5890fdda964224ee1da81e2b3.dll
Resource
win7-20240221-en
Target
c3a631f5890fdda964224ee1da81e2b3
Size
952KB
MD5
c3a631f5890fdda964224ee1da81e2b3
SHA1
9c2719f6373d094c54c11534d9b437f7b47af4ca
SHA256
a31101833e7697b2e4523595be0caca3df4c357c4fed177b5a9e87f912803475
SHA512
79ac8264b279e667fadd23c36006cdd3e3d70793ec75513b1c4d9865afdd71194de4c646a2ea569f49c1c77f051cad24ca1b969168bab83bb05bf98de2ce148f
SSDEEP
24576:IXdmOsW26QLHJeqVWbH1G7WS6InopTiuLZw9:0mNW26QLH1V2H1PpIotiuL+9
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
c3a631f5890fdda964224ee1da81e2b3 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CreateSemaphoreA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
GetWindowPlacement
PathToRegion
waveOutPrepareHeader
OpenPrinterA
RegCreateKeyExA
ShellExecuteA
OleInitialize
RegisterTypeLi
ord17
closesocket
ChooseColorA
?��1?
RunDllHostCallBack
��??����?1��?��
������?
����?��
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ