TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr
Behavioral task
behavioral1
Sample
8500a165d7fce68c8f35c42fe71065b4e225a82ed8d8d2860d37cb91d4e0eeee.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8500a165d7fce68c8f35c42fe71065b4e225a82ed8d8d2860d37cb91d4e0eeee.exe
Resource
win10v2004-20240426-en
Target
8500a165d7fce68c8f35c42fe71065b4e225a82ed8d8d2860d37cb91d4e0eeee
Size
2.3MB
MD5
e3da88c8c1964718d97aa0f186adbd36
SHA1
af47b0379c940df68e99bc7166e34e36d8d616a3
SHA256
8500a165d7fce68c8f35c42fe71065b4e225a82ed8d8d2860d37cb91d4e0eeee
SHA512
98112b91dd8b267b02c2b0b71a8e9ff99141152a71a27f3da12d3d2b9c3eb63abf16f6e7eaa6478cee875a97045f28e3f375a278163600306b5553d5c9950595
SSDEEP
3072:Bo9KilSB3h7Htl53DNlhLsVxaAReRKmxuyRi4GSk7jdk4o2n6E409aJTxL9+lQfg:jnADReRKmjoJoLEG84oSNd0t
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
8500a165d7fce68c8f35c42fe71065b4e225a82ed8d8d2860d37cb91d4e0eeee |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE