D:\gitfile\x51\httpProxy\httpProxyClient\Release\proxy_netbar.pdb
Behavioral task
behavioral1
Sample
9903ee608bf2833ff94db176e71e803db221812942d93d0567c4115590c7c592.dll
Resource
win7-20240903-en
General
-
Target
9903ee608bf2833ff94db176e71e803db221812942d93d0567c4115590c7c592
-
Size
1.3MB
-
MD5
d6dcaec7d4a85851178c7a96adcaf29e
-
SHA1
f89148f25190f235572354bb166d1fbf9be5e752
-
SHA256
9903ee608bf2833ff94db176e71e803db221812942d93d0567c4115590c7c592
-
SHA512
d3004fb59927a9047d5a526e3b73f5482e144dec763195cb74e191b359d8b499b7f8d9d2b28743c877be7ce091782c136b71ea86093f268091d23fdea2b1dee8
-
SSDEEP
24576:qd9PZnPrHiFN52iIH38xrE/kPNQ42VIpSepo4JFrtiojddpVeXdX4eFDV5m:kLiN52i638Rrd5pSeq4JFrttjdd7eCe
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9903ee608bf2833ff94db176e71e803db221812942d93d0567c4115590c7c592
Files
-
9903ee608bf2833ff94db176e71e803db221812942d93d0567c4115590c7c592.dll windows:5 windows x86 arch:x86
037be15b5cd688114bdf645dbadbb532
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GetVersionExW
SetThreadPriority
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
ws2_32
htons
version
VerQueryValueA
shlwapi
StrChrA
user32
TranslateMessage
advapi32
CryptGetHashParam
oleaut32
VariantClear
wldap32
ord301
winmm
timeGetDevCaps
Exports
Exports
3=5������?�#SW�Ke�5�g>E�>�!��!�%&9�cW� j2�_��iP G��n���j6�ں���',o}���n]c��{tj���0,�-.�İ��M�ࠓ6C��}�VM�|T@�>���s�ƅ��=j�i�Љ�F H�m��)>�����i v�IhoG���_W����D<�C��ʕ�|+z�M�cN�}�aQ{����� ;i$Ke���w4o��J�ܜI�b)1u�$-��,�M��!��������A�_����l��V���@*���f�av�{��D�"���--��sjCŴ���ʔ��4xqz_L�L&�Ц�#��E#V�7N�;��uB8sǻ�"�F����\�dċ���etڍ�Ȁ�U�נT�]���,�'i��,�Y�vL�G�����4�Y�&za#=^@y�O�!U���thy1�J�^���w ��=#_AD��#���X�D�^w�M�_9R�>G�<FlD�]�,h.�CF� ��]���J��g�j%�e��E����ō�cT\���)U p�v�2UD0�.[�{�E]9`�tͪh�AL�b��o�v��ܖ�6�ᜋ0f;��uA�ܯ'(�.�TGpʵ;�W�Q�P(ܜ0b�4��I ��#��q�TyuGqF�4K��~2F4�����=^K��JNb0@�N�P-5����1-��gb<�,EO���? V��9��%I1�u����3J���BG#7A �*���qȥ�ʅo�d�]���Q6O4�"ԥ��UrO�3�����X^�c'i���ر�������8�"��y����y2�w�\�x6��dCj�������V���1m[%���1,:�Q�5�<' ��F~W�?��?�7b� ��b���7���E�p�F��jVag�Ft���;��Ŋ���G�O����l�-_��~���JA�+\~��D��Xx�}�������!������P4��^��h��*O�y�n�g��it�hU!�fA�ꚓ֠7���.^�bBe�9��4�5�s/T"<�F� �b�T��wG�n*C�h����.�De01�5�����������1�O>�j�$E�;sR�O7��ɗ��F0$�4��4��"�(H �����?��6?Xx<���Sa��1�ꓬTpF��a'���������rD$�s���8<��-_��Vj�0��v��ʝ#��ogsO���LO+�Ԍ[�Ù�y�f9��U��n��w=���������c��DX��O���}x�B�z�VP�3�'E��q��}�G�b'i5�-��ӦEN����B���}�ԌC�/�iz��5��J�Ѫq $�vw}&�����AS;��rp�w��?�&�����.��QcYE��'���6eԊ���^��ȯ�Ͳd���Rؗ��Aдv��W��j3|vXS� �o��z6�:�Md� �2L��`>�m�MF;���pN��G���E��j�,(�qP����[�X4V&��SZ��d��3m,#9��m�����h�f\|.RJ11���ˎ#�l��b���sz�^N�,(���Dž(����w���2B+��r��O���@J5�� X�}`�_33��+�n������n퀷@ޤ|���m�-.@1�ᣛ������<~����8��v7C�b_.� �>l��U ��!g2���������F��0��Z���C�=�7�y���N�ʷJt�� [���+�1q�C�-�"���`W��e<��՜��.���%rA���b�i+ �d,������J���#dKN��P�U�7��N��l܍W�7'AB�/̣�Z�/���L��;,�c젬2���C�c�J0$�֦"u���~uGڼ���E#�|ˤ��g�)$n�%��a���+,�U�ό�j5ъ�F 6nn���GU�>U� &�$�N�dD��w��̲������ۻȣ��g�V���Ԟ����!���w���!���� �,ģK��W���U]^��@�(~��>��r1W��5�Iq4�c(�J{�w����O��p��|�2R@�P�{�h"5A��F ���p�&,ө_M�و~� ��9��P�#��.��6�n��]�����6�vVg۹�U����co^�.V������%������Ϧ�H�a��z�k^M5 �L�Ң��8h˪����O�$^�P���i�?T�z��T�▾�u�F�E���K8���UK�bh�+�7N;4���/��*0-�ԍ.��h�P�b�:���2�l�v����JՇe�D��p�gB5�8��g��Ȉ���GD��K���j�Y^>�����zJ��Vq�+g�C��yI�@��0w�ٕ~T��+3��R;�JDJ6���<]|�_�L��Bp���)�?�R"@4�����%T�d�AoJ��Ъߕ��1�dd�l5O��Ѕ�/�u����IL?H���x�d^�T���}M���<������o�A�����j�Z�ͳ�]�6+�LZA�T0��i������5�] �]O�Ԛh�A�u:��S����'���f���`rk��:�xpY {(���azq��� ���Ҝ�Bj��V�c�<j K:pj�:�>]O�ΘNs�K������j14���5�#Is_�yk gĄ���M����� ����Fُ�=l@Dp�~W��x�=���f���eZ:��H�h�R!�X��%��O�a�e|��l�����sy��]��4�p���-�Za��,x�gɧ!���KMbf�%� �l1U�/���f�k��!r�o��Z�<��\�V2�A�'�H��ӊL�3�8)#�3� �z���{��h��&����g�۞�!��O�2��Z�aB������ R��Cm��Z��E�.>��CV�IV'�����R�a?��N�V��}H�9Չ�;�������F��4n}��v-t�6���i_��5P�.D�Q�D� �U������e�!�y�7���`�"��CC���!3�\�e���u_�1�� G�̥1���2�����@*�冓�MK��t�d�<�^��.s���#�^ �GlG���&ę���#�L��k�3�τ�
p_sc
plstart
plstart_v2
plstart_v3
plugin_uninit
Sections
.text Size: - Virtual size: 914KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 202KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 710KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 460B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 633B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ