![]() The input sample is signed with a certificate issued by "CN=Thawte Timestamping CA, OU=Thawte Certification, O=Thawte, L=Durbanville, ST=Western Cape, C=ZA" (SHA1: 6C:07:45:3F:FD:DA:08:B8:37:07:C0:9B:82:FB:3D:15:F3:53:36:B1 see report for more information) Possibly tries to detect the presence of a debugger Source Hybrid Analysis Technology relevance 10/10 ![]() See related instructions: ".+0 push ebp+1 mov ebp, esp+3 sub esp, 00000098h+9 mov eax, dword ptr +14 xor eax, ebp+16 mov dword ptr, eax+19 lea eax, dword ptr +25 push eax+26 mov dword ptr, 00000094h+36 call dword ptr GetVersionExA+42 cmp dword ptr, 02h+49 jne 3F1557F4h". Which is directly followed by "cmp dword ptr, 02h" and "jne 3F1557F4h". See related instructions: ".+61 call 3F157DC0h+66 add esp, 0Ch+69 lea eax, dword ptr +72 push eax+73 mov dword ptr, 00000094h+80 call dword ptr GetVersionExA+86 cmp dword ptr, 02h+90 jne 3F155A2Fh". Which is directly followed by "cmp dword ptr, 02h" and "jne 3F155A2Fh".
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |