Run
Start
Behavioral task
behavioral1
Sample
61ad37b39465752d15c92741c8e01440b50043aea13b0b9c4e99f2e674d20da5.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
61ad37b39465752d15c92741c8e01440b50043aea13b0b9c4e99f2e674d20da5.dll
Resource
win10v2004-20240226-en
Target
61ad37b39465752d15c92741c8e01440b50043aea13b0b9c4e99f2e674d20da5
Size
2.3MB
MD5
c55da826e50e2615903607e61968778f
SHA1
d8773a702d47b6231a378cbeb0f8ff5797442803
SHA256
61ad37b39465752d15c92741c8e01440b50043aea13b0b9c4e99f2e674d20da5
SHA512
18dfee4e73913dc07312f9bb13969ca07179c9c982a1863d9b047ee700c9537b36ed17a77d1ae044344cea140c98fe772c6697d859641ce9cb71f45955685272
SSDEEP
49152:U15/Mh/dCyYh9qrjqcIvr1ocFtRicW0Wp3IUj1sDyezFgmKnaEhk:EQ4yYm3dID1FFtsH9NIUaDyezFgmKTi
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
61ad37b39465752d15c92741c8e01440b50043aea13b0b9c4e99f2e674d20da5 |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetProcAddress
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Run
Start
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ