PP_Init
PP_Input
Behavioral task
behavioral1
Sample
f79a9cb75d27520159a5d4f846b707a80e5d53ef8baf696066821459e7bb57fc.dll
Resource
win7-20240704-en
Target
f79a9cb75d27520159a5d4f846b707a80e5d53ef8baf696066821459e7bb57fc
Size
1.8MB
MD5
420903b414018f43a4ecaca1d6d6c904
SHA1
f7411436010e9c7cd964b3fec3195c3f711548fa
SHA256
f79a9cb75d27520159a5d4f846b707a80e5d53ef8baf696066821459e7bb57fc
SHA512
90e945d3f0105f3e86c19ad3d55d384ce070283a42b70428bc16e2c58f28868a5cca2b1402d0da9b23fb6706e1a440efd68f4f6ee834fb04f6f594bc5f441723
SSDEEP
24576:OEAQ9pK1m4j7EwImQ1KS1K1USVlrRPGEwVPpUTLUM/lTy0bxnNJjDxKlp2lI0yUo:IQe1zjwwAkp1RqVhTI3Zxq2lRNgdG2
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
f79a9cb75d27520159a5d4f846b707a80e5d53ef8baf696066821459e7bb57fc |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetVersionExW
LoadLibraryA
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetClassNameA
CharUpperBuffW
WTSSendMessageW
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
PP_Init
PP_Input
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ