Behavioral task
behavioral1
Sample
0b5ca5b6e1d087c9d292e6b2f757bfccf4162351c6c43ad8b666669581582478.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
0b5ca5b6e1d087c9d292e6b2f757bfccf4162351c6c43ad8b666669581582478.exe
Resource
win10v2004-20230703-en
General
-
Target
0b5ca5b6e1d087c9d292e6b2f757bfccf4162351c6c43ad8b666669581582478
-
Size
1.2MB
-
MD5
18e83740600a9b347ec9f03210965a39
-
SHA1
1148bfe3a2daa29418a46811aa1bc5aa07a2f9c4
-
SHA256
0b5ca5b6e1d087c9d292e6b2f757bfccf4162351c6c43ad8b666669581582478
-
SHA512
54c2f5d7d515b0637939498fed9e6c56fce0d2326d70d0b61d9d43950386eecb176598ddcf64d5c773d93a0bf5594836209cd4d04bc226265b3e93bb24f71dd6
-
SSDEEP
24576:XiV8ImwxdIYpw4qB0qQ5GQgOizLPTnNp8iHU2b1U3YXM3tpTLUqwOtgma9Mr4r:Xi9AYK4GjQ5GQgfLrvo2b1aYUHXLtgmQ
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0b5ca5b6e1d087c9d292e6b2f757bfccf4162351c6c43ad8b666669581582478
Files
-
0b5ca5b6e1d087c9d292e6b2f757bfccf4162351c6c43ad8b666669581582478.exe windows x86
3c7b253a0ff65506f5775b75b67d6894
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersion
GetVersionExA
LCMapStringA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
IsWindow
gdi32
DeleteDC
winmm
midiStreamClose
winspool.drv
OpenPrinterA
advapi32
RegCloseKey
shell32
Shell_NotifyIconA
ole32
OleInitialize
oleaut32
UnRegisterTypeLi
comctl32
ord17
ws2_32
recvfrom
comdlg32
GetOpenFileNameA
Sections
.text Size: - Virtual size: 482KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 134KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 859KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ