Behavioral task
behavioral1
Sample
99da5c2b711fa6fd03ac23c12d04549ce589f4f312228b82b80598964f1efc28.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
99da5c2b711fa6fd03ac23c12d04549ce589f4f312228b82b80598964f1efc28.exe
Resource
win10v2004-20230703-en
General
-
Target
99da5c2b711fa6fd03ac23c12d04549ce589f4f312228b82b80598964f1efc28
-
Size
10.1MB
-
MD5
72c7191e82739dd4ad04a20c11cf6df7
-
SHA1
17f29a29f71a075bb57bfe40447e3c500e757412
-
SHA256
99da5c2b711fa6fd03ac23c12d04549ce589f4f312228b82b80598964f1efc28
-
SHA512
27272c13e51316c927b83eb5079e823b909a792b084ea0fbcfb6bf58806b812e14913b89d9f97f65eea84ab5e7be69f1b6ada162e0ebbf4290f720b178d03800
-
SSDEEP
196608:uSUlruRxBzYO338PE8brbla744GuUcVmZGp0k9QgWWR:bWmxBzYacHnM744NEeQXWR
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 99da5c2b711fa6fd03ac23c12d04549ce589f4f312228b82b80598964f1efc28
Files
-
99da5c2b711fa6fd03ac23c12d04549ce589f4f312228b82b80598964f1efc28.exe windows x86
58a3c62fcbe32dba704a8b3c81e5e56d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutGetNumDevs
ws2_32
ioctlsocket
kernel32
GetVersionExA
GetVersion
WriteFile
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CharUpperA
gdi32
PatBlt
winspool.drv
DocumentPropertiesA
advapi32
RegCreateKeyExA
shell32
ShellExecuteA
ole32
CLSIDFromString
oleaut32
SafeArrayAccessData
comctl32
ImageList_Destroy
comdlg32
GetFileTitleA
Sections
.text Size: - Virtual size: 892KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 483KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 377KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 8.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 9.8MB - Virtual size: 9.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 364KB - Virtual size: 361KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ