Behavioral task
behavioral1
Sample
3db2397dfff8b93df3ec5b6a82a5b53e78bbabef79b39b6ae00f1ecc0d65ffc7.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
3db2397dfff8b93df3ec5b6a82a5b53e78bbabef79b39b6ae00f1ecc0d65ffc7.exe
Resource
win10v2004-20230703-en
General
-
Target
3db2397dfff8b93df3ec5b6a82a5b53e78bbabef79b39b6ae00f1ecc0d65ffc7
-
Size
3.1MB
-
MD5
1607be87bce610cec1d221700e2bc01a
-
SHA1
af8e2d1cd943b467810d038949a16abdda33c42d
-
SHA256
3db2397dfff8b93df3ec5b6a82a5b53e78bbabef79b39b6ae00f1ecc0d65ffc7
-
SHA512
78ef74f467993f08e8eb2bdde205834ed37bb09c858b6bbcfc82b8a7fe211514794bc7afbbda40fe5cee7650ad6bfa8ec629ff5d71f4688289baaf25e00954c5
-
SSDEEP
49152:kqo4ta2ZTXzsP9e6uDKvkO4nCyvs7E0EI54b3aoZK9GfmhKob:kqFta8sr1x4CpiI54b33c9Gfcz
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3db2397dfff8b93df3ec5b6a82a5b53e78bbabef79b39b6ae00f1ecc0d65ffc7
Files
-
3db2397dfff8b93df3ec5b6a82a5b53e78bbabef79b39b6ae00f1ecc0d65ffc7.exe windows x86
8061cc3c812c2b2b104cbe4f18c08edb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
crypt32
CryptQueryObject
user32
LoadIconW
kernel32
GetVersionExW
GetProcAddress
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
advapi32
RegOpenKeyExW
gdi32
SetMapMode
winspool.drv
DocumentPropertiesW
bcrypt
BCryptGenRandom
oleacc
LresultFromObject
ws2_32
select
wldap32
ord216
ole32
CoUninitialize
oleaut32
VariantChangeType
shell32
DragFinish
shlwapi
PathStripToRootW
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 373KB - Virtual size: 373KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 153KB - Virtual size: 153KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 61KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 46KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ