E:\编程代码\最新\最新一套\小何一次性及服务\03.ycx\Release\Project1.pdb
Behavioral task
behavioral1
Sample
a22604b1b5f8646168734e2f8fab0cfd01018331f4436e7265ce1b1b81302f1e.exe
Resource
win7-20240903-en
General
-
Target
a22604b1b5f8646168734e2f8fab0cfd01018331f4436e7265ce1b1b81302f1e
-
Size
946KB
-
MD5
4f927ef004715eb028cb5cee00435629
-
SHA1
9a1129d5e793ecbb5f9c3b2263a7bbf04312a69c
-
SHA256
a22604b1b5f8646168734e2f8fab0cfd01018331f4436e7265ce1b1b81302f1e
-
SHA512
b9cd0fddc7b081f10e4c3cdd38cee59a6ab8e72fb9ff70bb0515ac1d65e0ca148b3a4d121615eaf680094276c75b5914843c6757f32593eb121232531ecf7e48
-
SSDEEP
24576:uwzQPHpEWGY6aARcHftEIejaTx6bjRZTeaAG7Xut:XiepY6aM2KjOxujRZTnPs
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a22604b1b5f8646168734e2f8fab0cfd01018331f4436e7265ce1b1b81302f1e
Files
-
a22604b1b5f8646168734e2f8fab0cfd01018331f4436e7265ce1b1b81302f1e.exe windows:5 windows x86 arch:x86
9dfff77ae5587cf9a3d43b0d0ecdfa28
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
EncodePointer
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
advapi32
RegCloseKey
ole32
CoCreateInstance
oleaut32
SysAllocString
ws2_32
inet_ntoa
user32
MessageBoxW
Sections
.text Size: - Virtual size: 112KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 695KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 944KB - Virtual size: 943KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 360B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ