DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
b98360a30f4557891c833e51acc655e83ea462c9479ff8410ff66093d4a6a3f3.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
b98360a30f4557891c833e51acc655e83ea462c9479ff8410ff66093d4a6a3f3.dll
Resource
win10v2004-20240611-en
Target
b98360a30f4557891c833e51acc655e83ea462c9479ff8410ff66093d4a6a3f3
Size
7.0MB
MD5
391f42857b91ade89b7e02ed18d56bfb
SHA1
7056932b9784a8f0021ad8c2e7b9a4913b27f63e
SHA256
b98360a30f4557891c833e51acc655e83ea462c9479ff8410ff66093d4a6a3f3
SHA512
5148926836624316cf7f03e56cd8d8bdbc1967aabb03d602fba152977c187bec04128a4d5af7a2b4163bb72332036b990c48b25a27d3b1628d7f409a50f80ef3
SSDEEP
98304:qdS6kfYRcpFhOQicJS4ReYUNBwgLGRn6IaHlrHgY5YdG3D/Wgm6vrw59ezEVL0cq:qdr2FUQicDgY71JYH5edax0WzwIQn
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
b98360a30f4557891c833e51acc655e83ea462c9479ff8410ff66093d4a6a3f3 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
__vbaVarTstGt
WTSSendMessageW
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ