Behavioral task
behavioral1
Sample
3fbc51e692b9387dce847723e3f25fa9c55bbb9784367bb4403e61cbfdae57e1.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
3fbc51e692b9387dce847723e3f25fa9c55bbb9784367bb4403e61cbfdae57e1.exe
Resource
win10v2004-20230220-en
General
-
Target
3fbc51e692b9387dce847723e3f25fa9c55bbb9784367bb4403e61cbfdae57e1
-
Size
1.9MB
-
MD5
9c05c86b20f25488ae27edd0d2034b08
-
SHA1
ba56cd7f7f3c85f948332c15e696c303a35f65df
-
SHA256
3fbc51e692b9387dce847723e3f25fa9c55bbb9784367bb4403e61cbfdae57e1
-
SHA512
7253c9203c3748a8948fbb57b993a2eb6f9cf212f857d23c25b38a38912c67cac1aa0b74c65357cec0dbadd6aafaff2288ee7e9e4d0347065ee4b6f03a425df9
-
SSDEEP
49152:VG84jaOKPHY6Gn+1rzwSL0dJx5MOnSRPlig:w84+Xgn+1/wnf9APlj
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3fbc51e692b9387dce847723e3f25fa9c55bbb9784367bb4403e61cbfdae57e1
Files
-
3fbc51e692b9387dce847723e3f25fa9c55bbb9784367bb4403e61cbfdae57e1.exe windows x86
85fd934dcba03c94ed17a7f34d935585
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasGetConnectStatusA
kernel32
GetVersion
GetVersionExA
GetCurrentThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetCapture
gdi32
GetClipBox
winmm
waveOutGetNumDevs
winspool.drv
ClosePrinter
advapi32
RegSetValueExA
shell32
ShellExecuteA
ole32
OleUninitialize
oleaut32
LoadTypeLi
comctl32
ImageList_Destroy
ws2_32
WSACleanup
wininet
InternetCanonicalizeUrlA
comdlg32
GetSaveFileNameA
Sections
.text Size: - Virtual size: 569KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 878KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 196KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 877KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ