Behavioral task
behavioral1
Sample
fe0fb5ef276e100a35475ac2376d21c62b6965cde502bef2eb4a17f092baa7c3.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
fe0fb5ef276e100a35475ac2376d21c62b6965cde502bef2eb4a17f092baa7c3.exe
Resource
win10v2004-20230703-en
General
-
Target
fe0fb5ef276e100a35475ac2376d21c62b6965cde502bef2eb4a17f092baa7c3
-
Size
112KB
-
MD5
eb8d530ea1a5f6662472270f2e1aa02e
-
SHA1
b1193f90dc263fb3427936a5e5a92dd59b072656
-
SHA256
fe0fb5ef276e100a35475ac2376d21c62b6965cde502bef2eb4a17f092baa7c3
-
SHA512
415a917968c24d0e7ef13a8381c9d59774c5c6e69023a65c2e70ed0cc15b59ba568a7d4a3ffd06bed856d60275773153b773a5787314ec85d167dc9dfb01bc92
-
SSDEEP
3072:WwxolzEtk0SFRZFoUj4rYCSoK1khQOHE:sut3SFPFoo4Rop
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fe0fb5ef276e100a35475ac2376d21c62b6965cde502bef2eb4a17f092baa7c3
Files
-
fe0fb5ef276e100a35475ac2376d21c62b6965cde502bef2eb4a17f092baa7c3.exe windows x86
fe9afbb78d36e4485ca2cedfcc699e3f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord582
kernel32
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Sections
.text Size: - Virtual size: 156KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 100KB - Virtual size: 99KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 100B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ