Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20230703-en
General
-
Target
tmp
-
Size
12.0MB
-
MD5
4649323a98b20731e5d08781b0d16f4c
-
SHA1
69bb1673aa7d044c19f2e406925b6e4648b2cc6f
-
SHA256
56bed87be2ed0fefab223da1c378b3d4d18b17af54ffb35b36b1c899ff239637
-
SHA512
138722379d3bea0839b687f55fb6823a441271b471e36f5687d65e5c66b9b5efcdb069a7b8994665aea5954dae132e6ac2721a910736ab050c686b8f1b9b3bf6
-
SSDEEP
196608:3de+A68sFfp6+nZkP8N2dngUeI1TBmOfzlecsJ88zK4ZvecbCkOHNPrpRGB+zH+x:3U+A68ihqPGUeIRBmkt4dtfOPrtfUs+b
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource tmp
Files
-
tmp.exe windows x86
90baccf9c6aa371867c989ece97b0068
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
iphlpapi
GetAdaptersInfo
winmm
midiStreamStop
ws2_32
connect
version
VerLanguageNameA
kernel32
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
CheckMenuItem
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
CreateRectRgn
msimg32
GradientFill
winspool.drv
ClosePrinter
comdlg32
ChooseColorA
advapi32
RegEnumValueA
shell32
SHGetSpecialFolderPathA
ole32
CoRevokeClassObject
oleaut32
VariantCopyInd
comctl32
ImageList_DragEnter
oledlg
ord8
wininet
DeleteUrlCacheEntry
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 6.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 12.0MB - Virtual size: 12.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ