InsertSvc
ServiceMain
UninstallSvc
Behavioral task
behavioral1
Sample
ac668abf208e03a11e29cc9cabdb5f80ec57f2a76a9539efe6f664b3d99b73e4.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ac668abf208e03a11e29cc9cabdb5f80ec57f2a76a9539efe6f664b3d99b73e4.dll
Resource
win10v2004-20240412-en
Target
ac668abf208e03a11e29cc9cabdb5f80ec57f2a76a9539efe6f664b3d99b73e4
Size
2.3MB
MD5
62046fd940286d7ea69325c18479e3df
SHA1
6ffe30269be222445c0991a9243447e3e3a7192f
SHA256
ac668abf208e03a11e29cc9cabdb5f80ec57f2a76a9539efe6f664b3d99b73e4
SHA512
65cc9673097287c2b29678ff2b7b61d2b2a8c4ee8c1a6cbc3bb5e28ec7182012ad22710589dfb97a94bb5e6546a3b20c58781bd8449b3e8ee44887dfbf538bcf
SSDEEP
49152:45uZF6KtMeMZayaPXHxdq7M+z9f3I88WQF+yV29dLQgQYhpjtM1D:OUHMroBdho9f3DzyATQgxpa
resource | yara_rule |
---|---|
sample | INDICATOR_EXE_Packed_VMProtect |
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
ac668abf208e03a11e29cc9cabdb5f80ec57f2a76a9539efe6f664b3d99b73e4 |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
WriteConsoleW
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
StartServiceA
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
FwpmGetAppIdFromFileName0
InternetReadFile
inet_addr
GetTcpTable2
WTSQueryUserToken
WTSSendMessageW
CreateEnvironmentBlock
CharUpperBuffW
InsertSvc
ServiceMain
UninstallSvc
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ