Behavioral task
behavioral1
Sample
c817bb3609f89b4260ac79aa5a9932f72d9a9555aae4bce2cbb4585f5f5b4add.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
c817bb3609f89b4260ac79aa5a9932f72d9a9555aae4bce2cbb4585f5f5b4add.exe
Resource
win10v2004-20230220-en
General
-
Target
cd46b53882d04f2315c904c557d8a103.bin
-
Size
229KB
-
MD5
d03d67729137a8d1d37c2edcb5f34c81
-
SHA1
ef82115d875494646cc9bcac9b56a0b084bfe56e
-
SHA256
a2cd8cd6217b4db468f8cd5333ed2f01275267843c7918ad05eeda05119a8747
-
SHA512
be4e580b8852ab39f6fff40c45b26e70f2a62b3ec7041f509cd2db223828c72185fa5e1cabf6de1b531cb3a4f803de3106cec7201ea5666f45026db0f183a55e
-
SSDEEP
6144:Qkx+hDIhU1TUqAkqMatykt6c7TCJxP63lI1yfZIoq7cGc6XWPLYf:QkQhuU1GTAk3XCHPSlI1yhIL7cGxmUf
Malware Config
Signatures
-
Processes:
resource yara_rule static1/unpack001/c817bb3609f89b4260ac79aa5a9932f72d9a9555aae4bce2cbb4585f5f5b4add.exe vmprotect
Files
-
cd46b53882d04f2315c904c557d8a103.bin.zip
Password: infected
-
c817bb3609f89b4260ac79aa5a9932f72d9a9555aae4bce2cbb4585f5f5b4add.exe.exe windows x64
Password: infected
e9c6ece0d4fde432853679567de5e50b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
EncodePointer
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SendMessageA
Sections
.text Size: - Virtual size: 85KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 125KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 239KB - Virtual size: 239KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 36B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ