Hookoff
Hookon
InstallService
KsCreateAllocator
KsCreateClock
KsCreatePin
KsCreateTopologyNode
Behavioral task
behavioral1
Sample
cbac9b7a45896f7b648bf3950ac3c4ab.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
cbac9b7a45896f7b648bf3950ac3c4ab.dll
Resource
win10v2004-20240226-en
Target
cbac9b7a45896f7b648bf3950ac3c4ab
Size
29KB
MD5
cbac9b7a45896f7b648bf3950ac3c4ab
SHA1
91aa579bae35c2078d29e4793c5f84cfcca7c583
SHA256
0558fb1ceb03dc50b23593f6b41f0352d1cce54954bd1fc1ad111be989f2ebd4
SHA512
3888a340a4f156f7a024c00c57024e837aa41c42910a29056beb0dd16f552da0b560685fbcb6259b2b5302c8f4d7d916bc3da6045455887fb6fabcedc2e3a982
SSDEEP
768:gBaLxv5KPsZuHof2RrMGB1Wh0NAQh2hHz32zzsMASZcVU:GaCPo+WSnwhT36ASeU
resource | yara_rule |
---|---|
sample | upx |
resource | yara_rule |
---|---|
static1/unpack001/out.upx | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
cbac9b7a45896f7b648bf3950ac3c4ab |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Hookoff
Hookon
InstallService
KsCreateAllocator
KsCreateClock
KsCreatePin
KsCreateTopologyNode
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ