Behavioral task
behavioral1
Sample
e3b96f950b57d0dcf01616d7cdd63682f4833deb2b2b7460fdbb034c1232ed7b.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
e3b96f950b57d0dcf01616d7cdd63682f4833deb2b2b7460fdbb034c1232ed7b.exe
Resource
win10v2004-20230703-en
General
-
Target
e3b96f950b57d0dcf01616d7cdd63682f4833deb2b2b7460fdbb034c1232ed7b
-
Size
6.8MB
-
MD5
e87e2873572f1fe30af1032038caf17b
-
SHA1
8103b60cbc88e3a8e3f39a60d029b57ddd5e6353
-
SHA256
e3b96f950b57d0dcf01616d7cdd63682f4833deb2b2b7460fdbb034c1232ed7b
-
SHA512
e5fc6bf3cecd2cabb91f8b336bd5c2bbe865c398129bde317a08541afb25705904f7b4785d12c2420958dd37b46460466f05ca5863a6467158b39466facab136
-
SSDEEP
196608:mlA4i/aEtPZ+xyS1pTYoxP+gg/HD2E5a16AF0WFAo:mlA4i/9tBlVokN/HD2E5a1nF0W+
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e3b96f950b57d0dcf01616d7cdd63682f4833deb2b2b7460fdbb034c1232ed7b
Files
-
e3b96f950b57d0dcf01616d7cdd63682f4833deb2b2b7460fdbb034c1232ed7b.exe windows x86
8a75e9143fdd7fc430e24908e3638ed9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasHangUpA
winmm
midiStreamRestart
ws2_32
WSAAsyncSelect
kernel32
GetTimeZoneInformation
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetClipboardData
MessageBoxA
gdi32
ExtSelectClipRgn
winspool.drv
OpenPrinterA
advapi32
RegQueryValueA
shell32
SHGetSpecialFolderPathA
ole32
OleRun
oleaut32
SafeArrayAccessData
comctl32
ImageList_Destroy
wldap32
ord29
wininet
InternetCanonicalizeUrlA
comdlg32
ChooseColorA
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 6.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 361KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 200KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 6.8MB - Virtual size: 6.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ