FxDecryptFile
FxGetFileHeader
Behavioral task
behavioral1
Sample
c6be6799b833b319329560142cea34baae5691543f1c2a01a91982e6515a1a8f.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c6be6799b833b319329560142cea34baae5691543f1c2a01a91982e6515a1a8f.dll
Resource
win10v2004-20240508-en
Target
c6be6799b833b319329560142cea34baae5691543f1c2a01a91982e6515a1a8f
Size
3.7MB
MD5
2dd39ae069e07bb15df5c75342f29b5f
SHA1
4d7c6fc39978d0e3c929841e8480aa9c93ea5995
SHA256
c6be6799b833b319329560142cea34baae5691543f1c2a01a91982e6515a1a8f
SHA512
ebba2070eae04671f6712617942565fbedd6812f15bfe1bbaa4b3d4305891aa5942c77e7313e6abeacc088804f5b76f9833f4a9a34f7af28fb2ac179ec7d476a
SSDEEP
49152:6LozW+UTKv3T4lizLdg8WCwz95NdJ8vuafMk7BorFLLKkRXqrLFp6oe3s9RSdtls:6LH+3ZzLdg9Km8B2t/XwFsdtlgIy
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
c6be6799b833b319329560142cea34baae5691543f1c2a01a91982e6515a1a8f |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
WriteProcessMemory
WriteFile
lstrlenA
GetModuleFileNameA
GetSystemInfo
FindClose
FindFirstFileA
lstrcpyA
LoadLibraryExA
lstrcpynA
GetSystemTime
GetLocalTime
ReadFile
SetFilePointer
GetFileSize
SizeofResource
LockResource
LoadResource
FindResourceA
GetVersion
WaitForSingleObject
CreateProcessA
GetTempPathA
GetSystemDirectoryA
LocalFree
GlobalUnlock
LocalLock
GlobalAlloc
DeviceIoControl
ReleaseSemaphore
CreateSemaphoreA
GetPrivateProfileStringA
IsBadReadPtr
GetCurrentProcess
VirtualProtectEx
VirtualAlloc
VirtualFree
GetVersionExA
lstrcatA
FreeLibrary
GetCurrentProcessId
OpenProcess
TerminateProcess
LoadLibraryA
CreateFileA
GetLastError
GetProcAddress
GetModuleHandleA
GetTickCount
CloseHandle
QueryPerformanceCounter
GlobalMemoryStatus
GetStdHandle
GetFileType
GetCurrentThreadId
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
GetUserObjectInformationW
GetProcessWindowStation
MessageBoxA
SetCursor
GetDesktopWindow
wsprintfA
LoadCursorA
MessageBoxW
RegOpenKeyExA
ReportEventA
DeregisterEventSource
RegEnumKeyExA
RegCloseKey
RegisterEventSourceA
Netbios
_strnicmp
free
malloc
_except_handler3
atol
fclose
fread
fopen
_ltoa
_stricmp
_pctype
__mb_cur_max
_isctype
realloc
memchr
fwrite
fflush
_setmode
ftell
fseek
fgets
abort
wcsstr
_vsnprintf
vfprintf
_iob
strcmp
qsort
fprintf
_initterm
_adjust_fdiv
mktime
localtime
__CxxFrameHandler
time
srand
rand
??2@YAPAXI@Z
strrchr
??3@YAXPAX@Z
_fileno
memmove
FxDecryptFile
FxGetFileHeader
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ