Behavioral task
behavioral1
Sample
211e56cfebf1079ff07d76a303bce1835b6fbc17d84ae5f7c81bce6bfba3ec4f.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
211e56cfebf1079ff07d76a303bce1835b6fbc17d84ae5f7c81bce6bfba3ec4f.exe
Resource
win10v2004-20230220-en
General
-
Target
6dc9e261edd148e80897933fb8ba140976c30270df98fb0d4b2f6d2b3d61d8dd
-
Size
3.8MB
-
MD5
c214067ce9590d78c5da17f4912bb5da
-
SHA1
73fee043af6cf37713ed6732c1d20e5901fd3e38
-
SHA256
6dc9e261edd148e80897933fb8ba140976c30270df98fb0d4b2f6d2b3d61d8dd
-
SHA512
99f76ad8f50249f3420ab9294f3838089812495d5c0df624898208809231fad275cc8caf71220e7ebf768c2864dd5269df894687c264144b13593c6de40b192a
-
SSDEEP
98304:9mpZaZ+7yTZdB+HLZsMe3mW8vHByn3ivH:9WMZy+dc1/lynyH
Malware Config
Signatures
-
resource yara_rule static1/unpack001/211e56cfebf1079ff07d76a303bce1835b6fbc17d84ae5f7c81bce6bfba3ec4f.exe vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/211e56cfebf1079ff07d76a303bce1835b6fbc17d84ae5f7c81bce6bfba3ec4f.exe
Files
-
6dc9e261edd148e80897933fb8ba140976c30270df98fb0d4b2f6d2b3d61d8dd.zip
Password: infected
-
211e56cfebf1079ff07d76a303bce1835b6fbc17d84ae5f7c81bce6bfba3ec4f.exe.exe windows x86
d3b5af061cdc20768c148c4b96cb15ed
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetVersion
GetACP
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CharUpperBuffW
Sections
.text Size: - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 163KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 553KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 3.8MB - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE