TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr
Static task
static1
Behavioral task
behavioral1
Sample
e04cdba2c9443b7a859fb328cf19fecd73b6a91d0964b405d56a42ee0721c671.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
e04cdba2c9443b7a859fb328cf19fecd73b6a91d0964b405d56a42ee0721c671.exe
Resource
win10v2004-20240226-en
Target
e04cdba2c9443b7a859fb328cf19fecd73b6a91d0964b405d56a42ee0721c671
Size
670KB
MD5
85b2a7f42dff2d06d9b80acbde26de71
SHA1
5bf37573ba0ad897f57f636e7a98aaa24717ab32
SHA256
e04cdba2c9443b7a859fb328cf19fecd73b6a91d0964b405d56a42ee0721c671
SHA512
b058f4e07184c0506f14901f34534177af01cb14e098fe7f1b393d9808c0f6cc8ecc41f8e240f1a5bde291de519cfd16422c344bac71672ce74a283a1afebad8
SSDEEP
12288:A3uIyqWtM1lLMCbXV+kQmlrYezd52Xj/o9BMy5P1wssL6LxbUip41R9tdJsBXsVX:AxWtcIiM7O3zvCj/+Bbtwss+eW4FJsBg
resource | yara_rule |
---|---|
sample | INDICATOR_EXE_Packed_MPress |
Checks for missing Authenticode signature.
resource |
---|
e04cdba2c9443b7a859fb328cf19fecd73b6a91d0964b405d56a42ee0721c671 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_BYTES_REVERSED_HI
GetModuleHandleA
GetProcAddress
ClosePrinter
ImageList_Add
ShellExecuteW
IsEqualGUID
VerQueryValueW
GetDC
VariantInit
NetWkstaGetInfo
RegLoadKeyW
Pie
TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE