Behavioral task
behavioral1
Sample
c9310ee3550c9d9858ea7c9bfec85471108e450c04a0a7f6e32b07df031f5fb8.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
c9310ee3550c9d9858ea7c9bfec85471108e450c04a0a7f6e32b07df031f5fb8.exe
Resource
win10v2004-20230703-en
General
-
Target
c9310ee3550c9d9858ea7c9bfec85471108e450c04a0a7f6e32b07df031f5fb8
-
Size
5.9MB
-
MD5
bf82cfeef373867fde06ea23bab3d72b
-
SHA1
ca1af6f3eaf9ad44b651ca0c5056906848a39345
-
SHA256
c9310ee3550c9d9858ea7c9bfec85471108e450c04a0a7f6e32b07df031f5fb8
-
SHA512
1f8450e5a1454e5caa773ded98b0537c532bd97b632fd5be7802583c1cb85e7d60a61725620736950455cc256d65489b95de0eef70ae2bc75464987fdf74cf5b
-
SSDEEP
98304:U0lRvCvmcAJLOuxIB2Xzlp8Fzc4drKR42VMZ0CQrXO:UAvCvmJLwsXz3oAarQI09r
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c9310ee3550c9d9858ea7c9bfec85471108e450c04a0a7f6e32b07df031f5fb8
Files
-
c9310ee3550c9d9858ea7c9bfec85471108e450c04a0a7f6e32b07df031f5fb8.exe windows x86
47a249e4fc7d8632c583286fc00cde09
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvfw32
DrawDibDraw
avifil32
AVIStreamInfoA
kernel32
GetVersionExA
GetVersion
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
OffsetRect
gdi32
DeleteDC
winmm
midiStreamProperty
winspool.drv
OpenPrinterA
comdlg32
ChooseColorA
advapi32
RegQueryValueA
shell32
ShellExecuteA
ole32
CoCreateInstance
oleaut32
UnRegisterTypeLi
comctl32
_TrackMouseEvent
ws2_32
WSACleanup
Sections
.text Size: - Virtual size: 703KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 397KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 5.9MB - Virtual size: 5.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ