E:\编程代码\最新\最新一套\小何一次性及服务\03.ycx\Release\Project1.pdb
Behavioral task
behavioral1
Sample
cc7cc0c0818dc26e29edbfd122652582e95301f4a4a421b312d6e67b8cdb65ab.exe
Resource
win7-20240729-en
General
-
Target
cc7cc0c0818dc26e29edbfd122652582e95301f4a4a421b312d6e67b8cdb65ab
-
Size
916KB
-
MD5
fa361a5500ebbc839de91624cf3f6661
-
SHA1
055dcd5920f87545f4f329b87b54f0d92f6fde96
-
SHA256
cc7cc0c0818dc26e29edbfd122652582e95301f4a4a421b312d6e67b8cdb65ab
-
SHA512
372bead4b3d42731320beb573eb450472170c4f8232cfb3506764b573cc7e46954ca0e138807a1c161ecfc67c3b16544893b609653d54bca10d55749a0cf7c4f
-
SSDEEP
24576:tZ5Wc3imyIw4cTTjY8wZDDMVoRbFQCRyy/tqyHtdcVjeRHOzAG7Xut:tzx3iDf7jhwZfwWbq6yy/t5NdzwzPs
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cc7cc0c0818dc26e29edbfd122652582e95301f4a4a421b312d6e67b8cdb65ab
Files
-
cc7cc0c0818dc26e29edbfd122652582e95301f4a4a421b312d6e67b8cdb65ab.exe windows:5 windows x86 arch:x86
a3ca39c9ba41e04cb6f41b4626feac24
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
advapi32
AdjustTokenPrivileges
ole32
CoSetProxyBlanket
oleaut32
SysAllocString
ws2_32
WSAStartup
user32
MessageBoxW
Sections
.text Size: - Virtual size: 112KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 668KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 914KB - Virtual size: 913KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ