executeScript
inject
isAttached
Behavioral task
behavioral1
Sample
XcHvYYrNa.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
XcHvYYrNa.dll
Resource
win10v2004-20240426-en
Target
XcHvYYrNa.dll
Size
5.2MB
MD5
9c2243e5192b30565cbe44f1ad3be5c9
SHA1
24ecdb04ba4c01bf07d3957c0cd18d7d446da559
SHA256
f20f4a36ee204d1aa08e9f6cb71b7a0432d8b8ed6c123ba41e1759db0829dd2c
SHA512
f6694a02ded735c6a19c0c70d083076ebe604016d4e0fda25da9c83eaa123a1ed989c2a4d7f70447b336aa7172aaf973c7fe22f6a2ce30482b320ebaf0322995
SSDEEP
98304:okspyHyGvnNu6GE36orJnWpDT72shjm5Bq3N/7Z+rncO9jRqof/MHPS2mN:oVpyHyyN61BpX72shCmFZ+rVlRqo72mN
resource | yara_rule |
---|---|
sample | themida |
Checks for missing Authenticode signature.
resource |
---|
XcHvYYrNa.dll |
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
executeScript
inject
isAttached
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_READ