?InstallKeyHook@@YGHXZ
?InstallMouseHook@@YGHXZ
?KeyHookProc@@YGJHIJ@Z
?MouseHookProc@@YGJHIJ@Z
?RMS_BltTo@@YAXXZ
?UninstKeyHook@@YGHXZ
?UninstMouseHook@@YGHXZ
Init
Behavioral task
behavioral1
Sample
778beccc1bcd67f4a8a2c161ae5f1990N.dll
Resource
win7-20240903-en
Target
778beccc1bcd67f4a8a2c161ae5f1990N.exe
Size
620KB
MD5
778beccc1bcd67f4a8a2c161ae5f1990
SHA1
e287c17f2fa93b51a8eee23974732607704f1059
SHA256
a412260464121fa5d7b9be278ec1ce2d6608f6f616424f60c2c8e003979b29c5
SHA512
a60fa1696d3398e0b56a8f57006bf0267dc943c96cde0f6a5fc9e2187553259a2b686aceb106bb798740beea9d4c585b2e1e9787393628418b59c992985ad1aa
SSDEEP
12288:RYpG1H6bdV+GWYiVyIE2oQs+x5FESSXuZfhOEPuME2fXHJUzVcD3v:RYI1abdV0YiVpEFQs+1SyfNs2PJUZgv
resource | yara_rule |
---|---|
sample | vmprotect |
Checks for missing Authenticode signature.
resource |
---|
778beccc1bcd67f4a8a2c161ae5f1990N.exe |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetVersionExA
GetVersion
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
ClientToScreen
GetStockObject
ShellExecuteA
CoInitialize
VariantClear
HttpQueryInfoA
ord39
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
?InstallKeyHook@@YGHXZ
?InstallMouseHook@@YGHXZ
?KeyHookProc@@YGJHIJ@Z
?MouseHookProc@@YGJHIJ@Z
?RMS_BltTo@@YAXXZ
?UninstKeyHook@@YGHXZ
?UninstMouseHook@@YGHXZ
Init
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ