Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20230703-en
General
-
Target
tmp
-
Size
9.3MB
-
MD5
684f1a7d79237190be28ad1930c0a720
-
SHA1
0504d19c9b993820789e65a25a3e7eaeedce13bc
-
SHA256
4398af310d686e694b4df54ed22993f0b5839f05fb7e21f27a3b12af011b1817
-
SHA512
27c6b4c1b5d6187342d886e770f9dc83d304eff973b2e9add207f31a80909b1d606035706c22ffd4339735aa8dcd1310c76a961bf8fbaf3c1cdfcf705a8deac0
-
SSDEEP
196608:NW4JO4U9vznaE2vYKHytOO2CNSK2f5QvMUbDQ40CgnXBZWqBfS87hK:NW4J98znuvCOOX8K2ffs2jnXBZWqBfL
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource tmp
Files
-
tmp.exe windows x86
15459a762d1207e768963304f042d262
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
d3dx9_43
D3DXGetImageInfoFromFileInMemory
d3d9
Direct3DCreate9
kernel32
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SendMessageA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
LineTo
advapi32
CryptGetUserKey
shell32
SHGetFolderPathA
ole32
CoInitialize
oleaut32
VariantClear
iphlpapi
SendARP
dbghelp
MiniDumpWriteDump
wsock32
send
msvcr90
memchr
dinput8
DirectInput8Create
crypt32
CryptMsgClose
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 694KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 856KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 6.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 9.1MB - Virtual size: 9.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 150KB - Virtual size: 150KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ