ReflectiveLoader
boat
launch
prepare
Static task
static1
Behavioral task
behavioral1
Sample
2edd928dd04202b29b104e861df3dcda41ec16b98a6322b6d2c72bd0e2b0e770.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2edd928dd04202b29b104e861df3dcda41ec16b98a6322b6d2c72bd0e2b0e770.dll
Resource
win10v2004-20240426-en
Target
2edd928dd04202b29b104e861df3dcda41ec16b98a6322b6d2c72bd0e2b0e770
Size
821KB
MD5
547c000aba8cf5873858938eea9f7e5b
SHA1
8784dd37a1d7344a888611f3740244567c0011ea
SHA256
2edd928dd04202b29b104e861df3dcda41ec16b98a6322b6d2c72bd0e2b0e770
SHA512
1f5cd9be704e1f0e617a9afc567f6900cde6a121830aba8df2988eb97eccbba3b8dc83f573fa3b51720fa31e86251a2dbec5442e3aef85cc41cc16ea0989088f
SSDEEP
24576:ABqhU1PKUx5zLye5IIZ5hPPeAip1CoW3kGzKSsCwyExWt:ABqhU1PKU3PJop0oWzK5Cwy
resource | yara_rule |
---|---|
sample | INDICATOR_SUSPICIOUS_ReflectiveLoader |
resource | yara_rule |
---|---|
sample | INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb |
Checks for missing Authenticode signature.
resource |
---|
2edd928dd04202b29b104e861df3dcda41ec16b98a6322b6d2c72bd0e2b0e770 |
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
GetFileAttributesA
Process32NextW
OutputDebugStringW
CreateFileA
Process32FirstW
GetSystemInfo
GetLogicalDriveStringsA
GetProcAddress
LocalFree
GlobalMemoryStatusEx
CreateProcessA
GetDiskFreeSpaceExA
lstrcmpiW
GetTickCount
IsDebuggerPresent
CreateThread
ExitProcess
GetComputerNameExA
ReadFile
WriteProcessMemory
CreateMutexA
WaitForSingleObject
GetComputerNameExW
OpenMutexA
LoadLibraryA
VirtualAllocEx
GetFileSize
GetCurrentProcessId
CreateSemaphoreW
GetComputerNameA
GlobalFree
FileTimeToSystemTime
FileTimeToLocalFileTime
GetSystemTimeAsFileTime
CreateMutexW
ReleaseMutex
GetLastError
GetSystemTime
lstrlenW
FindFirstFileW
Sleep
CreateToolhelp32Snapshot
GetModuleHandleA
LocalAlloc
GetDriveTypeA
DeviceIoControl
GetStdHandle
GetCurrentProcess
SetLastError
GetModuleFileNameA
MapViewOfFile
CreateFileMappingA
CloseHandle
OpenProcess
WriteConsoleW
HeapSize
GetTimeZoneInformation
GetStringTypeW
SetEndOfFile
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetFullPathNameW
GetCurrentDirectoryW
SetStdHandle
FlushFileBuffers
GetFileSizeEx
LCMapStringW
CompareStringW
GetConsoleCP
ReleaseSemaphore
TerminateProcess
IsWow64Process
MultiByteToWideChar
HeapFree
HeapReAlloc
HeapAlloc
GetProcessHeap
ResumeThread
ExitThread
QueueUserAPC
VirtualProtectEx
GetThreadContext
CreateRemoteThread
SetThreadContext
OpenMutexW
OpenFileMappingA
QueryPerformanceCounter
FreeLibrary
SleepEx
WideCharToMultiByte
GetSystemDirectoryW
LoadLibraryW
VerSetConditionMask
GetModuleHandleW
VerifyVersionInfoW
FormatMessageA
ExpandEnvironmentStringsA
GetCurrentThreadId
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
RtlUnwindEx
InterlockedFlushSList
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
GetModuleHandleExW
SetFilePointerEx
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
GetModuleFileNameW
GetConsoleMode
ReadConsoleW
WriteFile
RtlUnwind
FindWindowA
GetCursorPos
CryptDestroyHash
GetTokenInformation
OpenProcessToken
LookupAccountSidA
ConvertStringSecurityDescriptorToSecurityDescriptorW
CryptReleaseContext
CryptGenRandom
CryptAcquireContextW
CryptGetHashParam
CryptCreateHash
CryptHashData
RegGetValueA
RegCloseKey
RegQueryValueExA
GetUserNameA
RegOpenKeyExA
CoCreateInstance
CoInitializeEx
CoInitializeSecurity
CoUninitialize
VariantClear
SysFreeString
SysAllocString
SysAllocStringLen
WinHttpCloseHandle
WinHttpOpen
WinHttpGetProxyForUrl
InternetQueryOptionW
htons
setsockopt
WSAGetLastError
WSAStartup
recv
connect
socket
inet_addr
closesocket
bind
ioctlsocket
sendto
listen
select
accept
getaddrinfo
freeaddrinfo
WSASetLastError
WSAIoctl
__WSAFDIsSet
htonl
send
WSACleanup
getsockopt
ntohs
getsockname
getpeername
GetTcpTable
GetModuleFileNameExA
GetProcessMemoryInfo
GetModuleBaseNameA
EnumProcesses
EnumProcessModulesEx
ReflectiveLoader
boat
launch
prepare
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ