Behavioral task
behavioral1
Sample
5de1dc902d808fb87d4fe3a3a97dfb17ec84379f8e0fdc3c0445378e08d767ad.exe
Resource
win7-20230712-en
General
-
Target
5de1dc902d808fb87d4fe3a3a97dfb17ec84379f8e0fdc3c0445378e08d767ad
-
Size
2.0MB
-
MD5
c1a6640f485dc45d85dfc98a2d18d957
-
SHA1
5b4cb714ad36e697bb0016cf016521bce548ed5c
-
SHA256
5de1dc902d808fb87d4fe3a3a97dfb17ec84379f8e0fdc3c0445378e08d767ad
-
SHA512
f1f55c0a1615e273dc1a99729f71cce0b473e211f5577e8926fdea7c22af2360b286c1a9721cc6de3b4a3d6bc3bd30542376242868132cb0ba5a4956f0eaa703
-
SSDEEP
49152:eBk+6iVL1iTEjO9p12rv0KQHg3FtvpoximHClzmw41AE88GAI:FjiVL1e6O9n+xQCtOHHqz14GE8VAI
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5de1dc902d808fb87d4fe3a3a97dfb17ec84379f8e0fdc3c0445378e08d767ad
Files
-
5de1dc902d808fb87d4fe3a3a97dfb17ec84379f8e0fdc3c0445378e08d767ad.exe windows x86
6d843dc23fcb587eef25797c94eda79f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetVersion
GetLocaleInfoA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
WindowFromPoint
gdi32
ExtSelectClipRgn
winmm
waveOutOpen
winspool.drv
ClosePrinter
advapi32
RegSetValueExA
shell32
Shell_NotifyIconA
ole32
OleUninitialize
oleaut32
UnRegisterTypeLi
comctl32
ImageList_Destroy
ws2_32
inet_ntoa
comdlg32
ChooseColorA
Sections
.text Size: - Virtual size: 719KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 845KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 296KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 954KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ