Behavioral task
behavioral1
Sample
cd9437cd9c5dc3a3063199ef6e812d04af1727fe34147caca33088b9d5156e45.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
cd9437cd9c5dc3a3063199ef6e812d04af1727fe34147caca33088b9d5156e45.exe
Resource
win10v2004-20230221-en
General
-
Target
cd9437cd9c5dc3a3063199ef6e812d04af1727fe34147caca33088b9d5156e45
-
Size
3.9MB
-
MD5
284b5a14c1277cc3dd63b081198c1c43
-
SHA1
e0aa08fd99667368247e9de9a12423af56250aba
-
SHA256
cd9437cd9c5dc3a3063199ef6e812d04af1727fe34147caca33088b9d5156e45
-
SHA512
f4d786d98790489ce5607e662e70d7dfb793260d368fb2fd0d432a8b4cf2315bd84f8966e9d306a12d0e5f9d0ed5a3f2b365854a6eddfaacfe8f89bfd1f31bf0
-
SSDEEP
98304:A85vFlw/fkYLz7ckXR8FCnafXbXM2QHu/ublQee:35vFGE6R8FK8XMgub2e
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cd9437cd9c5dc3a3063199ef6e812d04af1727fe34147caca33088b9d5156e45
Files
-
cd9437cd9c5dc3a3063199ef6e812d04af1727fe34147caca33088b9d5156e45.exe windows x86
c9cea34b31672ec847010b1336bcb9cb
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetFilePointer
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
SetClipboardData
MessageBoxA
gdi32
GetSystemPaletteEntries
winmm
midiStreamRestart
winspool.drv
ClosePrinter
advapi32
RegCloseKey
shell32
ShellExecuteA
ole32
ReleaseStgMedium
oleaut32
VariantCopyInd
comctl32
ord17
ws2_32
recvfrom
wldap32
ord29
comdlg32
GetFileTitleA
Sections
.text Size: - Virtual size: 704KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 195KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.huzpsb Size: - Virtual size: 1.4MB
IMAGE_SCN_MEM_EXECUTE
.vmp0 Size: - Virtual size: 179KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 3.9MB - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 188B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ