Behavioral task
behavioral1
Sample
4d9953177192fa9633565a75716f01811e431b3b6cadf6d7162414ff1e17b7c6.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
4d9953177192fa9633565a75716f01811e431b3b6cadf6d7162414ff1e17b7c6.exe
Resource
win10v2004-20230703-en
General
-
Target
4d9953177192fa9633565a75716f01811e431b3b6cadf6d7162414ff1e17b7c6
-
Size
4.9MB
-
MD5
db04da6c8a283affac47ed31e6feb514
-
SHA1
d0caf9f80f72c5fd979f9eed53a3bc02e03b9aaa
-
SHA256
4d9953177192fa9633565a75716f01811e431b3b6cadf6d7162414ff1e17b7c6
-
SHA512
0de50aab872a7a409e96f840c1416a0a8b85a7c30505a1543743f1c5d3ff6ab9f74b875d972c70cd06e83e088e8be741de22374f3f96a4af8fed5a41bcb0a524
-
SSDEEP
98304:Lt9CXwDPXF8ptIlonlu+AqAkWYm3J4+Sa/YG1EtM06HrJ7NHP+Ry:ZENpSS9AN34+v/DyjIP+Ry
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4d9953177192fa9633565a75716f01811e431b3b6cadf6d7162414ff1e17b7c6
Files
-
4d9953177192fa9633565a75716f01811e431b3b6cadf6d7162414ff1e17b7c6.exe windows x64
3e73696745be6cc662a9286593381d96
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mediahelper
?MHDeleteInstance@@YAXPEAVIMediaManager@@@Z
utility
?common_log@@YAXPEBDZZ
bluraycreator
?BDCreatorNewInstance@@YAPEAVIBDCreator@@XZ
discburn
?DiscBurnNewInstance@@YAPEAVIDiscBurn@@XZ
dvdimage
MakeDVDImage
dvdcreator
?DVDCreatorDeleteInstance@@YAXPEAVIDVDCreator@@@Z
libeay32
ord3024
kernel32
GetStartupInfoA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CharUpperBuffW
gdi32
CreateDCW
shell32
ShellExecuteW
qt5widgets
??1QCheckBox@@UEAA@XZ
qt5gui
?height@QPixmap@@QEBAHXZ
qt5xml
??0QDomNode@@QEAA@XZ
qt5network
??0QLocalServer@@QEAA@PEAVQObject@@@Z
qt5core
?toInt@QVariant@@QEBAHPEA_N@Z
msvcp140
_Cnd_wait
vcruntime140
__CxxFrameHandler3
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-runtime-l1-1-0
_initterm_e
api-ms-win-crt-filesystem-l1-1-0
_getdrives
api-ms-win-crt-string-l1-1-0
strcmp
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: - Virtual size: 542KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 524KB - Virtual size: 524KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 4.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 4.3MB - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ