Behavioral task
behavioral1
Sample
76a93c325a6aa05ddcf70e7325a8ddd2753bab83280b6f640d182d70314f6f08.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
76a93c325a6aa05ddcf70e7325a8ddd2753bab83280b6f640d182d70314f6f08.exe
Resource
win10v2004-20230703-en
General
-
Target
76a93c325a6aa05ddcf70e7325a8ddd2753bab83280b6f640d182d70314f6f08
-
Size
3.1MB
-
MD5
97cc8899f4144e8a987c6d07be878f36
-
SHA1
618a3df5ba035a4a045bf1208216a5af8c6c5022
-
SHA256
76a93c325a6aa05ddcf70e7325a8ddd2753bab83280b6f640d182d70314f6f08
-
SHA512
c2afdfd60d003abe6e9ada596a40306080fe666d32ef5c74e21ab613686434b13695a01a3d2f933e7eedc2cc2463897c06de89db253684ec9269fe74f0d2ae7d
-
SSDEEP
49152:7fjMUQj0wB+A33ogu2N3huw+lFwPhhHQ5Rmfxno2M4EyX41zR2lt9RP1:7bi0whnogu29hzLJhHQ5gpnmvyXcQD1
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 76a93c325a6aa05ddcf70e7325a8ddd2753bab83280b6f640d182d70314f6f08
Files
-
76a93c325a6aa05ddcf70e7325a8ddd2753bab83280b6f640d182d70314f6f08.exe windows x86
418a6d7830b313efd57218076936b591
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamOut
ws2_32
socket
rasapi32
RasHangUpA
kernel32
MultiByteToWideChar
user32
GetMenuCheckMarkDimensions
gdi32
ExtSelectClipRgn
msimg32
GradientFill
winspool.drv
OpenPrinterA
advapi32
RegOpenKeyExA
shell32
Shell_NotifyIconA
ole32
CLSIDFromProgID
oleaut32
SafeArrayDestroy
comctl32
ImageList_Draw
wininet
InternetCanonicalizeUrlA
comdlg32
ChooseColorA
msvcrt
strncpy
iphlpapi
GetInterfaceInfo
psapi
GetMappedFileNameW
Sections
.text Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sedata Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.sedata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: 4KB - Virtual size: 256B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE