Behavioral task
behavioral1
Sample
cf883164876666d0481fe62561f393afafc37e6c6f8cf9a7b158a37e13aa89ff.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
cf883164876666d0481fe62561f393afafc37e6c6f8cf9a7b158a37e13aa89ff.exe
Resource
win10v2004-20230703-en
General
-
Target
cf883164876666d0481fe62561f393afafc37e6c6f8cf9a7b158a37e13aa89ff
-
Size
2.5MB
-
MD5
27a2fa0fa1ad27978bd19c0c47ba7623
-
SHA1
cf0c6fdfe0e60d69d2cc4e9d0b14c265ee23228c
-
SHA256
cf883164876666d0481fe62561f393afafc37e6c6f8cf9a7b158a37e13aa89ff
-
SHA512
ec4c5509c478238293ce7dd03d4723ccbe74f7e778553a7a553955fbddc634d1a744a9feeb3d870b7319382c8c39bae39b8626b1639836b0e2cab64248c2d770
-
SSDEEP
49152:kgiGXuywvZIJrS4PNOeI7jowtbb/QFycBLpaLB3k7/qBzm/Q:kgi+8wp7SjoCb/QFycBLIB3k7CBz
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cf883164876666d0481fe62561f393afafc37e6c6f8cf9a7b158a37e13aa89ff
Files
-
cf883164876666d0481fe62561f393afafc37e6c6f8cf9a7b158a37e13aa89ff.exe windows x86
27190b5296222f18aa12ba991803e1ae
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetDC
advapi32
DeleteService
gdi32
CreateDIBSection
winspool.drv
OpenPrinterA
comctl32
ImageList_GetIcon
shlwapi
PathFileExistsA
winmm
waveOutOpen
ws2_32
inet_ntoa
rasapi32
RasHangUpA
shell32
ShellExecuteA
ole32
CoCreateInstance
oleaut32
UnRegisterTypeLi
wininet
InternetCloseHandle
comdlg32
GetSaveFileNameA
Sections
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 762KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 578KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 60KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ