Behavioral task
behavioral1
Sample
9093f6ba1798128cf5692806670d8f5e4c41a008af87897df1b936a5d6a291bc.exe
Resource
win7-20230712-en
General
-
Target
9093f6ba1798128cf5692806670d8f5e4c41a008af87897df1b936a5d6a291bc
-
Size
9.3MB
-
MD5
47918de97077867937acc4e302813b5f
-
SHA1
0ed617905151198f459f68a45dcac8d9d665847d
-
SHA256
9093f6ba1798128cf5692806670d8f5e4c41a008af87897df1b936a5d6a291bc
-
SHA512
d5fb4d28c2d8168723e92dd8c0ade290348057bf01f05d780f9598d5746c6667418b215ea3519a4e50c6ac7cc96337ac39f80e01247ea923525ca26e9856d74c
-
SSDEEP
196608:/GkG4WN8054jOTEjjkpChTBMRU+SnVB0joBtKJItwU6lo9Yv0X16U70MgCMKHv0g:/SZt3jChT1+gWoBYItY69K0X1v0XCM
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9093f6ba1798128cf5692806670d8f5e4c41a008af87897df1b936a5d6a291bc
Files
-
9093f6ba1798128cf5692806670d8f5e4c41a008af87897df1b936a5d6a291bc.exe windows x86
951368db166f2e4d9c7c75e17e158416
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvfw32
DrawDibDraw
avifil32
AVIStreamInfoA
winmm
waveOutWrite
ws2_32
recvfrom
kernel32
GetVersionExA
GetVersion
GetThreadLocale
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
IsRectEmpty
gdi32
BeginPath
winspool.drv
OpenPrinterA
comdlg32
GetSaveFileNameA
advapi32
RegCloseKey
shell32
SHGetSpecialFolderPathA
ole32
OleUninitialize
oleaut32
LoadTypeLi
comctl32
ord17
Sections
.text Size: - Virtual size: 976KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 254KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 448KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 8.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 9.3MB - Virtual size: 9.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ