Behavioral task
behavioral1
Sample
609aba7519155ee0dd421868578b1b1ab69add05af9d61dcdff1ac04112802f7.exe
Resource
win7-20230712-en
General
-
Target
609aba7519155ee0dd421868578b1b1ab69add05af9d61dcdff1ac04112802f7
-
Size
1.8MB
-
MD5
ccfa571de94055a674de9580a51c0553
-
SHA1
589136c9be86c26657466ccb4b8df18580ecca0a
-
SHA256
609aba7519155ee0dd421868578b1b1ab69add05af9d61dcdff1ac04112802f7
-
SHA512
c0cde3f6ba5af70212af4af8daac0463d4d6f12e1d7ccdc561395d145944fe40003d04fa73080ea7368eefcb0eb056bbdb9d6a2b59f7fc7c22a247c6faa6ac8c
-
SSDEEP
49152:Hmf9Img7Y9pU0ZAtSCMOoPYFIz3BZTjgIuFF68:HU8h0ZlOETvgIuDh
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 609aba7519155ee0dd421868578b1b1ab69add05af9d61dcdff1ac04112802f7
Files
-
609aba7519155ee0dd421868578b1b1ab69add05af9d61dcdff1ac04112802f7.exe windows x86
23edbb12d93d3a2a77ead46640f94f6b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasGetConnectStatusA
winmm
waveOutRestart
ws2_32
closesocket
kernel32
GetVersionExA
GetVersion
HeapFree
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetForegroundWindow
gdi32
DeleteObject
winspool.drv
OpenPrinterA
advapi32
RegQueryValueA
shell32
SHGetSpecialFolderPathA
ole32
OleInitialize
oleaut32
UnRegisterTypeLi
comctl32
ord17
wininet
InternetReadFile
comdlg32
GetOpenFileNameA
Sections
.text Size: - Virtual size: 732KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 417KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 915KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 168KB - Virtual size: 164KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ