Behavioral task
behavioral1
Sample
0b2f116a68e48933e7ec289573f5a9699e52eeaa18bd4cc02ae8122abdea481a.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
0b2f116a68e48933e7ec289573f5a9699e52eeaa18bd4cc02ae8122abdea481a.exe
Resource
win10v2004-20230703-en
General
-
Target
0b2f116a68e48933e7ec289573f5a9699e52eeaa18bd4cc02ae8122abdea481a
-
Size
4.9MB
-
MD5
e4acb644a0c785e907fb7c37d190a2cc
-
SHA1
f7ffbb73062dc250e799ce06d5e49cd19fd1dc7b
-
SHA256
0b2f116a68e48933e7ec289573f5a9699e52eeaa18bd4cc02ae8122abdea481a
-
SHA512
ffb4b0ebe860223da20ccf0e98c2873e471a017bfa80a9fbcb10c605c0b2a085d5743be84f79cd480f461e6849fcb1a8a67abc35093540289732d26d0b6541b1
-
SSDEEP
49152:DEXTDVCt9CiwDKAp8EsATun7/bDMX9DpSwRuFHfFrzJW6XWRwZ5XbS8xZwmjo2bw:cot9CiwDK2U1VzVbs+oenRERvK9s2+j
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0b2f116a68e48933e7ec289573f5a9699e52eeaa18bd4cc02ae8122abdea481a
Files
-
0b2f116a68e48933e7ec289573f5a9699e52eeaa18bd4cc02ae8122abdea481a.exe windows x64
03259b00601ee4cb21e610bd3a333826
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mediahelper
?MHNewInstance@@YAPEAVIMediaManager@@XZ
utility
?common_log_uninit@@YAXXZ
bluraycreator
?BDCreatorDeleteInstance@@YAXPEAVIBDCreator@@@Z
discburn
?DiscBurnDeleteInstance@@YAXPEAVIDiscBurn@@@Z
dvdimage
MakeDVDImage
dvdcreator
?DVDCreatorDeleteInstance@@YAXPEAVIDVDCreator@@@Z
libeay32
ord3171
kernel32
GetCurrentProcessId
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
IsZoomed
gdi32
DeleteDC
shell32
ShellExecuteW
qt5widgets
?notify@QApplication@@UEAA_NPEAVQObject@@PEAVQEvent@@@Z
qt5gui
?drawRects@QPainter@@QEAAXPEBVQRect@@H@Z
qt5xml
?isElement@QDomNode@@QEBA_NXZ
qt5network
?errorString@QLocalServer@@QEBA?AVQString@@XZ
qt5core
?compare@QString@@QEBAHAEBV1@W4CaseSensitivity@Qt@@@Z
msvcp140
_Cnd_signal
vcruntime140
__C_specific_handler
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
api-ms-win-crt-time-l1-1-0
_localtime32
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-runtime-l1-1-0
_cexit
api-ms-win-crt-filesystem-l1-1-0
_getdiskfree
api-ms-win-crt-string-l1-1-0
strcmp
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 543KB - Virtual size: 542KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 524KB - Virtual size: 524KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 3.2MB - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 537KB - Virtual size: 536KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ