E:\编程代码\最新\最新一套\小何一次性及服务\03.ycx\Release\Project1.pdb
Behavioral task
behavioral1
Sample
0026b82bb728a56a9b873fc44addcc5e42ad0c869703c3cbb0160bbb2e0d888b.exe
Resource
win7-20240903-en
General
-
Target
0026b82bb728a56a9b873fc44addcc5e42ad0c869703c3cbb0160bbb2e0d888b
-
Size
956KB
-
MD5
9520e474f7d18cb5df48f07c5fe13fae
-
SHA1
93a885eb7a54aa62f0c543b9f74f47eea76baef6
-
SHA256
0026b82bb728a56a9b873fc44addcc5e42ad0c869703c3cbb0160bbb2e0d888b
-
SHA512
c20263d4e76ede95f8d9cad915f27c2de69f2b09542d67bf61089847975f77978c9370cb1ca5e74580a4325636403ff281337a1397362662360e535c7880ee61
-
SSDEEP
24576:9EFVJyiLFLpBbiep6Th5OIxbbiayFP80ngMAG7Xut:9EFPdZ3ehvVmMMPs
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0026b82bb728a56a9b873fc44addcc5e42ad0c869703c3cbb0160bbb2e0d888b
Files
-
0026b82bb728a56a9b873fc44addcc5e42ad0c869703c3cbb0160bbb2e0d888b.exe windows:5 windows x86 arch:x86
b3910ef7323078c8d9d2b5661034cdfc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
HeapReAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
advapi32
LookupAccountNameA
ole32
CoUninitialize
oleaut32
SysAllocString
ws2_32
inet_ntoa
user32
MessageBoxW
Sections
.text Size: - Virtual size: 112KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 711KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 954KB - Virtual size: 954KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 92B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ