Behavioral task
behavioral1
Sample
a2f49d7bc1d0f299da6b59cfa653df073ff74b841cae265520c87a920367bf11.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a2f49d7bc1d0f299da6b59cfa653df073ff74b841cae265520c87a920367bf11.exe
Resource
win10v2004-20221111-en
General
-
Target
433b813e066ee7ab3f5f11015705b659.bin
-
Size
4.8MB
-
MD5
d955037c362aa512b459f8739c39673e
-
SHA1
9cc385af59ed4a11587c11daa34875d55858073e
-
SHA256
985e4f15eb1f995bd889da2f4136f3fe9baa64173d39e598fdf5201b8c558a84
-
SHA512
bbd54d95e2b8a6d5e3564ea55714017048bd081521814de434408368be8e6570f497d3d3aee67f7853dfbd88c7dec0871054c093ab93ad5673418422e63ef71a
-
SSDEEP
98304:2JNKNMqQn7Y+s1/z6OnoxTaWtibJNYI0+G53bVeBU5ddS8y1Wrg:sKs75s17oxTasKJNHCsUfdS8y7
Malware Config
Signatures
-
Processes:
resource yara_rule static1/unpack001/a2f49d7bc1d0f299da6b59cfa653df073ff74b841cae265520c87a920367bf11.exe vmprotect
Files
-
433b813e066ee7ab3f5f11015705b659.bin.zip
Password: infected
-
a2f49d7bc1d0f299da6b59cfa653df073ff74b841cae265520c87a920367bf11.exe.exe windows x86
Password: infected
f51724e08a085aa5e9f0970616ead7ad
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetDesktopWindow
GetProcessWindowStation
GetUserObjectInformationW
gdi32
CreateCompatibleBitmap
advapi32
SystemFunction036
shell32
SHGetFolderPathA
crypt32
CryptUnprotectData
gdiplus
GdipGetImageEncodersSize
setupapi
SetupDiGetDeviceInterfaceDetailA
Sections
.text Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 163KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 4.8MB - Virtual size: 4.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 190KB - Virtual size: 2.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ