ZtlTaskMemAllocImp
ZtlTaskMemFreeImp
ZtlTaskMemReallocImp
Behavioral task
behavioral1
Sample
XolessumStory.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
XolessumStory.exe
Resource
win10v2004-20240709-en
Target
4d8586dc68863e5d48d76295e3121cc3_JaffaCakes118
Size
2.8MB
MD5
4d8586dc68863e5d48d76295e3121cc3
SHA1
bf4a1a2198581351a5fe964eddaf879f8e68e604
SHA256
1852175896eb5ce47fdc0f01658f0decf35f6d5806c3523f0966ff41681f9eef
SHA512
beab23c7eaaa51726acaa7ad8284f6bddb027e3c79df7804f65aa116aab69711c6759b2c3ff8e58f34f9a0778a099e730874135a9d5c2912844c8b899b8f4c51
SSDEEP
49152:K2PIJHADJ4Bq+gNxQbdmV8P5c/kHorLsUvH1T7eqJsMxGsHvOCSDKGXxTyHP2X5Q:HHJ4Dg58htH8LJ137JpxzHvOC+BTyHuW
resource | yara_rule |
---|---|
static1/unpack001/XolessumStory.exe | themida |
Checks for missing Authenticode signature.
resource |
---|
unpack001/XolessumStory.exe |
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
ZtlTaskMemAllocImp
ZtlTaskMemFreeImp
ZtlTaskMemReallocImp
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE