Behavioral task
behavioral1
Sample
0f94a063bfa7d66dedd86ba03763acaaccaf44f55e94607bf7cf3c2e230fe78d.exe
Resource
win7-20230220-en
General
-
Target
0f94a063bfa7d66dedd86ba03763acaaccaf44f55e94607bf7cf3c2e230fe78d
-
Size
3.1MB
-
MD5
dbc273a7ab70c5e22dc314712081c8f0
-
SHA1
18046929e0b3e5a565bb826fd91e667172e4422b
-
SHA256
0f94a063bfa7d66dedd86ba03763acaaccaf44f55e94607bf7cf3c2e230fe78d
-
SHA512
3d5d1af2252e0a57820238555a44dbc300d8d6810b68f6c5caf18567fbc430ade3b99093e95dc268df5c8a66e342b2a0262b78a39bec06c16ccd564ee49d1f4a
-
SSDEEP
49152:yJiZo2Nlx8/HZjw/0FBemB675mxCFlRH86cUstQjBIfq4bqt34Ub3Ttg:MC8/hpFdI5mxCFlRDcULIC4mt3Xb
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0f94a063bfa7d66dedd86ba03763acaaccaf44f55e94607bf7cf3c2e230fe78d
Files
-
0f94a063bfa7d66dedd86ba03763acaaccaf44f55e94607bf7cf3c2e230fe78d.exe windows x86
ef6fa2735b9ae4159286aade3492a9b7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutGetNumDevs
ws2_32
WSAAsyncSelect
kernel32
SetCurrentDirectoryA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CloseClipboard
gdi32
Escape
winspool.drv
OpenPrinterA
advapi32
RegCreateKeyExA
shell32
Shell_NotifyIconA
ole32
CLSIDFromString
oleaut32
LoadTypeLi
comctl32
ImageList_Destroy
comdlg32
GetSaveFileNameA
Sections
.text Size: - Virtual size: 658KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 357KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 837KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ