Behavioral task
behavioral1
Sample
f12c896731d66ddbefa22c319a076319ad7b060d8ab8572f7c8eb61de583c9ed.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
f12c896731d66ddbefa22c319a076319ad7b060d8ab8572f7c8eb61de583c9ed.exe
Resource
win10v2004-20230703-en
General
-
Target
f12c896731d66ddbefa22c319a076319ad7b060d8ab8572f7c8eb61de583c9ed
-
Size
11.9MB
-
MD5
7d86914006f2db2a90717bcf4a40edb9
-
SHA1
017fc18949f42299e5ab7f1d851a1562523972f3
-
SHA256
f12c896731d66ddbefa22c319a076319ad7b060d8ab8572f7c8eb61de583c9ed
-
SHA512
d6f427d003c1a51b4fdfea8a49f4f11b88fb1bbe16c86aa6f30bf89c85ab52c12796ad4b41be8c34dc56d8fd1d4095116ef6884cdae1634ed9ef3e887709940c
-
SSDEEP
196608:u0/e44ZpjzcBLIiG3Inhhh4AhhvxIJqTUzepprZ2rze4aJoXfRp8f5HVGDEIqCRz:EvYpIuhqYhvxIJqAzWtbEGRHADEIqyj/
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f12c896731d66ddbefa22c319a076319ad7b060d8ab8572f7c8eb61de583c9ed
Files
-
f12c896731d66ddbefa22c319a076319ad7b060d8ab8572f7c8eb61de583c9ed.exe windows x86
aa7ee4868819bf78617d32793641a838
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamOpen
ws2_32
ntohl
kernel32
GetVersionExA
GetVersion
GetEnvironmentStrings
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
PostQuitMessage
gdi32
GetDIBits
winspool.drv
OpenPrinterA
advapi32
RegCreateKeyExA
shell32
SHChangeNotify
ole32
CLSIDFromString
oleaut32
VariantClear
comctl32
ImageList_Destroy
comdlg32
ChooseColorA
Sections
.text Size: - Virtual size: 648KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 9.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 321KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 11.8MB - Virtual size: 11.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 88KB - Virtual size: 86KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ