Behavioral task
behavioral1
Sample
7e574a5a664ca46b7b3ccac03655553e3bab5033b435aa5bbb12dfb80adab21e.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
7e574a5a664ca46b7b3ccac03655553e3bab5033b435aa5bbb12dfb80adab21e.exe
Resource
win10v2004-20230220-en
General
-
Target
88456780bbdb79f303286d8283048247.bin
-
Size
1.1MB
-
MD5
21338e77bd2ebcfc0131a64f71b20ebb
-
SHA1
64a1385112bc417796f85b3f97cb80e897e03e0b
-
SHA256
c6adc8f0a5f046f65a46e370dd2713c926b9bb352c63e93281efbed6e4d3a453
-
SHA512
681c70c71af36e723a692a34653fe3dd8660a973c791623bff469d7df4c645269ded327f3ee405fd99199db152ae54c79ec8031ce1a7e125d60c4c5473539bb5
-
SSDEEP
24576:evL1IBJGhn32le3+0icKf7cVHRmTAw72SimEkXybtxS2kxSNS0Q:evL14J2vZSjcVxKHEkuINSNSL
Malware Config
Signatures
-
Processes:
resource yara_rule static1/unpack001/7e574a5a664ca46b7b3ccac03655553e3bab5033b435aa5bbb12dfb80adab21e.exe vmprotect
Files
-
88456780bbdb79f303286d8283048247.bin.zip
Password: infected
-
7e574a5a664ca46b7b3ccac03655553e3bab5033b435aa5bbb12dfb80adab21e.exe.exe windows x86
Password: infected
c519475e15ed02991a4a2a6bea17e253
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamOut
ws2_32
ntohs
rasapi32
RasGetConnectStatusA
kernel32
WideCharToMultiByte
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
ReleaseCapture
MessageBoxA
gdi32
GetSystemPaletteEntries
msimg32
GradientFill
winspool.drv
DocumentPropertiesA
advapi32
RegCloseKey
shell32
SHGetPathFromIDListA
ole32
CoTaskMemFree
oleaut32
SysAllocStringLen
odbc32
ord16
comctl32
ImageList_ReplaceIcon
oledlg
ord8
wininet
InternetCanonicalizeUrlA
comdlg32
GetSaveFileNameA
Sections
.text Size: - Virtual size: 821KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 460KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 363KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 44KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 233KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 944KB - Virtual size: 942KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 232B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ