Behavioral task
behavioral1
Sample
8c5181f9a5ed0a66d3f08670eae9d14adb7fc11d5aaa22a287e82c3af2ce4af6.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
8c5181f9a5ed0a66d3f08670eae9d14adb7fc11d5aaa22a287e82c3af2ce4af6.exe
Resource
win10v2004-20230220-en
General
-
Target
8c5181f9a5ed0a66d3f08670eae9d14adb7fc11d5aaa22a287e82c3af2ce4af6
-
Size
4.4MB
-
MD5
7ccaed750f5f66cdf13620952367e61e
-
SHA1
ada3efab768774e825656d02b4fa14bffd2814ad
-
SHA256
8c5181f9a5ed0a66d3f08670eae9d14adb7fc11d5aaa22a287e82c3af2ce4af6
-
SHA512
7d9a2936f449eb23986cd4a6dab8b7552d3d61b8925eba96b7cdd8f27842c0909417c29a773fc2f47d3003c2bb061da4d66d886f8d5671487faa7e9134978313
-
SSDEEP
49152:ErcHNu8lmztLMHl3O8RqhYeGXgGGdMU2PZfk8rl63YyXtvd6O2JNng+TVEgT0EXM:icbmzlM40UKfkXIjN/J7um9oInRWaP
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8c5181f9a5ed0a66d3f08670eae9d14adb7fc11d5aaa22a287e82c3af2ce4af6
Files
-
8c5181f9a5ed0a66d3f08670eae9d14adb7fc11d5aaa22a287e82c3af2ce4af6.exe windows x64
e3f2a0938909d56ca91222aeb6379a6b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
fltmgr.sys
FltUnregisterFilter
ntoskrnl.exe
ExAllocatePool
_stricmp
ExAllocatePool
NtQuerySystemInformation
ExFreePoolWithTag
IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
KeQueryActiveProcessors
KeSetSystemAffinityThread
KeRevertToUserAffinityThread
DbgPrint
hal
KeQueryPerformanceCounter
KeQueryPerformanceCounter
Sections
.text Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 512KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1024B - Virtual size: 924B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
PAGE Size: 512B - Virtual size: 76B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp0 Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 396B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 584B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ