DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
NSGetModule
RD_XXXX
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll
Resource
win10v2004-20240226-en
Target
SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll
Size
2.1MB
MD5
db4b8570e24a6820f9fc30bc34b75de4
SHA1
8eec515e7c75b3879ada16cd5f397e7c588dc193
SHA256
652e2c35d36d4b96fdda843b6339c185eab3263b0b8acdb6349df240d1b9f8e4
SHA512
0c24ee51414acc43a801263162077b18ba2bb14b579e8cf07d74521f53721f1dcafe0c51783ea5872d441cbd1f9996efc8c9ea1e06bcf811e8dce40538e93a34
SSDEEP
24576:hZKLBBcfI5epEbN1uSqwyMvSosVEcF2G6cTFOp/rzYIBCDT1Lvna:hZKLBBaI5eu1uStyUSosVtUFAoC
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
SecuriteInfo.com.Variant.Tedy.515774.17185.28729.dll |
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetProcessHeap
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
PostQuitMessage
MessageBoxA
SetDIBits
CryptExportKey
ord165
CoInitialize
RegisterTypeLi
ord64
PathFindFileNameW
?width@ios_base@std@@QBE_JXZ
ord7
_mkgmtime64
sqlite3_next_stmt
UuidFromStringA
GetFileVersionInfoSizeW
InternetTimeToSystemTimeW
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
NSGetModule
RD_XXXX
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ