test
Behavioral task
behavioral1
Sample
2579056ebda67e521b3d86d5deb9c451e0145b12b8836c3804f196608efe86cb.dll
Resource
win7-20230712-en
General
-
Target
2579056ebda67e521b3d86d5deb9c451e0145b12b8836c3804f196608efe86cb
-
Size
14.0MB
-
MD5
fcf7c09476bc18196255265251f74913
-
SHA1
117081852af5f78a81ae5b8700306daa544d3f9e
-
SHA256
2579056ebda67e521b3d86d5deb9c451e0145b12b8836c3804f196608efe86cb
-
SHA512
9895506d9d5973e7a90578857de151ed796326461eea12c19c6d601186e753661f2c8750b521a370c3f8b1c1c06d35e5c63ae1320085030cf05649e06cba2844
-
SSDEEP
393216:NDsxbLK18gkRVYlzgFwszyCCpV9/xAnq3fiLSsejd11/pL:tXl0FwINuV9/xAnqKLVY
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2579056ebda67e521b3d86d5deb9c451e0145b12b8836c3804f196608efe86cb
Files
-
2579056ebda67e521b3d86d5deb9c451e0145b12b8836c3804f196608efe86cb.dll windows x86
b6f0565d84acd726b0524d58efff2f03
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
winmm
waveOutPause
ws2_32
accept
msvfw32
DrawDibDraw
avifil32
AVIStreamInfoA
kernel32
GetVersionExA
GetVersion
GlobalFindAtomA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetWindowPos
gdi32
OffsetViewportOrgEx
winspool.drv
OpenPrinterA
comdlg32
GetSaveFileNameA
advapi32
RegCloseKey
shell32
ShellExecuteA
ole32
OleUninitialize
oleaut32
RegisterTypeLi
comctl32
ord17
Exports
Exports
Sections
.text Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 403KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 9.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 14.0MB - Virtual size: 14.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 100B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 12KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ