Behavioral task
behavioral1
Sample
bb2018.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
bb2018.dll
Resource
win10v2004-20230703-en
General
-
Target
bb2018.dll
-
Size
201KB
-
MD5
6f4b671473e343ff6eb0cd9951f24934
-
SHA1
dbebbc223cd39f5649867395438ef2750d90e32f
-
SHA256
a00178f72d569fd845cc8f7c5cb7c4f983ed0dfbe3176e15c42ae884dee2db36
-
SHA512
76f009757d9a6af55a75d39a14b6a10c240081fd7f2d9bfe7eb909f0e4122052961f9312fbbf52caa6e629ce97912be992dce63d301c7db3974f39b16a5f4d2c
-
SSDEEP
3072:2+ATME5JAC/T/2njLhbCDvmSOo2iePG3ufWC+vrXT/7nM4L3zxO1S+b2+QNOURoM:W9ygBm+Hjt3FwdnmgX4eo1uPESEz96
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bb2018.dll
Files
-
bb2018.dll.dll windows x64
79893c1cc594001b72824488bb5f118b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
FreeLibrary
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Sections
.text Size: - Virtual size: 54KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 61KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 158KB - Virtual size: 158KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ