Behavioral task
behavioral1
Sample
d2edd97558b740121493ed0e20c2ade14eee2cc13d6b8b79b72528658e804208.exe
Resource
win7-20230621-en
General
-
Target
d2edd97558b740121493ed0e20c2ade14eee2cc13d6b8b79b72528658e804208
-
Size
1.6MB
-
MD5
fe7eb8d338dc1afb97594de334aaa1f5
-
SHA1
a703495274f18741800db8ebd06ea0047b9876d7
-
SHA256
d2edd97558b740121493ed0e20c2ade14eee2cc13d6b8b79b72528658e804208
-
SHA512
38e4eb93fe6e8f896157f86cbb8a025fc90e5beda7ca1e16efbd472a419e4b0801f0537bee2e4e52719515a7c0090d2675c11fb4ae5a61699188d6de2fa0eb3a
-
SSDEEP
49152:jiqhtRapZ3211n1NasYLQcqz7OwlfbUU1Cue7Ny:j7hgdAlLaRLQci7xlQgCueU
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d2edd97558b740121493ed0e20c2ade14eee2cc13d6b8b79b72528658e804208
Files
-
d2edd97558b740121493ed0e20c2ade14eee2cc13d6b8b79b72528658e804208.exe windows x86
37a9db6e278ca13fef80504fc99ebb39
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutRestart
ws2_32
getpeername
kernel32
GetVersionExA
GetVersion
LoadResource
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
DestroyWindow
gdi32
GetBkMode
winspool.drv
DocumentPropertiesA
advapi32
RegCreateKeyExA
shell32
Shell_NotifyIconA
ole32
RevokeDragDrop
oleaut32
RegisterTypeLi
comctl32
ImageList_Destroy
wldap32
ord29
comdlg32
ChooseColorA
Sections
.text Size: - Virtual size: 682KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 315KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 297KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 931KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 56KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ