Behavioral task
behavioral1
Sample
c6a6f1f3baf94f19ec5622468ee8ec1696251691a0c358a464d3a8258c555a5f.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
c6a6f1f3baf94f19ec5622468ee8ec1696251691a0c358a464d3a8258c555a5f.exe
Resource
win10v2004-20230703-en
General
-
Target
c6a6f1f3baf94f19ec5622468ee8ec1696251691a0c358a464d3a8258c555a5f
-
Size
5.7MB
-
MD5
ef5bb1b56eeea63fb320c9c7fe4848ae
-
SHA1
ab078b331bcff03b030df3ef52a51f8efaa929b2
-
SHA256
c6a6f1f3baf94f19ec5622468ee8ec1696251691a0c358a464d3a8258c555a5f
-
SHA512
f39b62c7bc6aed119f685fc9f83b88402bad49599bf1051c0cfd83cdcf3b886f48c3f58346df1b85205f473607b58458cfd9c80aa9e74a9c1160dcc89c3b176e
-
SSDEEP
98304:qQCoFksmLakPQXMbXuDsDRvwlbo7K/rGRwNIEQB8RL69U0kjx5MCK2OHXe:eoFpbNXAeDsF8kK/rIxgL69UzFK2YX
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c6a6f1f3baf94f19ec5622468ee8ec1696251691a0c358a464d3a8258c555a5f
Files
-
c6a6f1f3baf94f19ec5622468ee8ec1696251691a0c358a464d3a8258c555a5f.exe windows x86
11633e8e37b6065e075c66681ba9d1ee
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamStop
ws2_32
socket
kernel32
GetVersion
GetVersionExA
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ScreenToClient
CharUpperBuffW
gdi32
PtVisible
winspool.drv
ClosePrinter
advapi32
RegOpenKeyExA
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
shell32
DragQueryFileA
ole32
CLSIDFromProgID
oleaut32
VariantClear
comctl32
ImageList_GetIcon
wldap32
ord29
comdlg32
GetOpenFileNameA
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 995KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 345KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.3MB - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 348KB - Virtual size: 347KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ