AlphaBlend
DllInitialize
GradientFill
TransparentBlt
vSetDdrawflag
Behavioral task
behavioral1
Sample
QQ(TM)Patch/msimg32.dll
Resource
win7-20240704-en
Target
6a23391bcbdba932393d7f27297868fc_JaffaCakes118
Size
4KB
MD5
6a23391bcbdba932393d7f27297868fc
SHA1
edf2d3ba2514ce327b6af5aa1950bf6369135511
SHA256
0f4f5761e387b3c034d1ad5424a01169c27b17a24733baff6d606a82cb8618b7
SHA512
700fcd9dd6b2ebde501f3c4c2942e699a00e1bfd8da665aca60793ccf7ac0c726f5588211b2747843287a2b531bd6ec8cda19b025db378bb665efc9ea2afb903
SSDEEP
96:X9hqCqC54nZf0iihrxN6w97nnevr1WLU/R/6mZZym6zZ0ywDn0vY:vHqC+nZsiilv6GnevrILGR/b7yDzEDnb
Detects file using ACProtect software.
resource | yara_rule |
---|---|
static1/unpack001/QQ(TM)Patch/msimg32.dll | acprotect |
resource | yara_rule |
---|---|
static1/unpack001/QQ(TM)Patch/msimg32.dll | upx |
Checks for missing Authenticode signature.
resource |
---|
unpack001/QQ(TM)Patch/msimg32.dll |
unpack002/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
AlphaBlend
DllInitialize
GradientFill
TransparentBlt
vSetDdrawflag
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ