CheckIME
Behavioral task
behavioral1
Sample
842d0f3bf639b1a729c5bbe81bba30bc4fd9927432913a3fc70a71fea52c41c9.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
842d0f3bf639b1a729c5bbe81bba30bc4fd9927432913a3fc70a71fea52c41c9.dll
Resource
win10v2004-20220812-en
General
-
Target
842d0f3bf639b1a729c5bbe81bba30bc4fd9927432913a3fc70a71fea52c41c9
-
Size
90KB
-
MD5
06e23de501c9a693c15a67ba41f2c430
-
SHA1
8f7e42ba6fb76b716f095fdb96491c4a57971943
-
SHA256
842d0f3bf639b1a729c5bbe81bba30bc4fd9927432913a3fc70a71fea52c41c9
-
SHA512
82d6ee8c93a05b82f2e6b4fbe0885bf539c0a32802b019e40b5e0b7b15c80db3489728c723ffea9b696fdca47177d720738f7647b20992976fd57b19e60da16c
-
SSDEEP
1536:3RNiVU4ijXgoSFbiTl9xMDPHEAvuJpJiGAsspYlSqdEsdC/It61:BgizgmT/xMDRuJpJiG8pGFEsq1
Malware Config
Signatures
-
Processes:
resource yara_rule sample vmprotect
Files
-
842d0f3bf639b1a729c5bbe81bba30bc4fd9927432913a3fc70a71fea52c41c9.dll windows x86
e3ede482e61bdf16e057a57ca6e0144a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
OutputDebugStringA
VirtualProtect
ExitProcess
lstrcmpA
Sleep
lstrcmpiA
GetFileSize
lstrcpynA
GetTempPathA
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
Process32Next
Process32First
CreateToolhelp32Snapshot
GetModuleHandleA
VirtualAlloc
lstrlenA
CreateThread
GetModuleFileNameA
OpenProcess
GetCurrentProcessId
WritePrivateProfileStringA
GetSystemTime
WideCharToMultiByte
VirtualFree
ReleaseMutex
CreateMutexA
WaitForSingleObject
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
GetCurrentProcess
IsBadReadPtr
TerminateProcess
GetProcessId
GetSystemDirectoryA
lstrcatA
lstrcpyA
GetTickCount
WriteFile
DeleteFileA
ReadFile
SetFilePointer
MoveFileExA
CopyFileA
CreateFileA
GetFileTime
SetFileTime
GetLastError
CloseHandle
LoadLibraryA
MultiByteToWideChar
GetProcAddress
GetPrivateProfileStringA
FreeLibrary
user32
PrintWindow
GetWindowInfo
SetForegroundWindow
ShowWindow
GetActiveWindow
FindWindowA
IsWindowVisible
GetWindowTextA
GetSystemMetrics
EnumWindows
FindWindowExA
GetWindowThreadProcessId
wsprintfA
GetDC
IsRectEmpty
IsIconic
ReleaseDC
gdi32
CreateDCA
DeleteObject
BitBlt
GetDeviceCaps
CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC
GetObjectA
GetStockObject
SelectPalette
SelectObject
RealizePalette
GetDIBits
advapi32
LookupPrivilegeValueA
AdjustTokenPrivileges
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
OpenProcessToken
msvcrt
_adjust_fdiv
_stricmp
_strlwr
_initterm
__CxxFrameHandler
fopen
fseek
ftell
fread
fclose
_local_unwind2
strrchr
memmove
strstr
??2@YAPAXI@Z
_except_handler3
printf
sprintf
??3@YAXPAX@Z
free
malloc
atoi
wcscmp
psapi
EnumProcessModules
ws2_32
shutdown
inet_ntoa
gethostbyname
gdiplus
GdipGetImageEncoders
GdipCloneImage
GdipDisposeImage
GdipFree
GdiplusStartup
GdipAlloc
GdipLoadImageFromFile
GdipGetImageEncodersSize
GdiplusShutdown
GdipSaveImageToFile
wininet
HttpAddRequestHeadersA
InternetConnectA
HttpOpenRequestA
HttpSendRequestExA
InternetCloseHandle
HttpEndRequestA
InternetOpenA
netapi32
Netbios
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
shlwapi
StrChrW
Exports
Exports
Sections
.text Size: 40KB - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 24KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ