Behavioral task
behavioral1
Sample
dc250b46301f221dbfb8b69852c30f2157b38a45d6e76f6afcc61e5f762252a8.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
dc250b46301f221dbfb8b69852c30f2157b38a45d6e76f6afcc61e5f762252a8.exe
Resource
win10v2004-20230703-en
General
-
Target
dc250b46301f221dbfb8b69852c30f2157b38a45d6e76f6afcc61e5f762252a8
-
Size
2.6MB
-
MD5
409dcb93731f6e813017f2f95e88cbc6
-
SHA1
5b0c9bb00a766f6177ce3c45a648f7285f67767c
-
SHA256
dc250b46301f221dbfb8b69852c30f2157b38a45d6e76f6afcc61e5f762252a8
-
SHA512
2a0e6df902e4579eb96e844ae860fd0f83726b8ee8fdd2c17ee28e7beaae6abcbe53123811ce1005bc4eaaa77ae784baa3da1aaeed65d17cef6b769de3faeef6
-
SSDEEP
49152:3TJdHQNOzZqwYRj1RCroQStgiFMO+shfi/voIUKmkF0tDRuXHZQ:3TJyNOzZqwYRj1RCroXtg6Mfkino/kWx
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dc250b46301f221dbfb8b69852c30f2157b38a45d6e76f6afcc61e5f762252a8
Files
-
dc250b46301f221dbfb8b69852c30f2157b38a45d6e76f6afcc61e5f762252a8.exe windows x86
de6ddb98c48a97b661d8ffdfb44bbd7a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvfw32
DrawDibDraw
avifil32
AVIStreamGetFrame
winmm
waveOutRestart
ws2_32
ntohl
kernel32
GetProcessVersion
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CreateDialogIndirectParamA
gdi32
StartDocA
msimg32
GradientFill
winspool.drv
OpenPrinterA
comdlg32
GetOpenFileNameA
advapi32
RegSetValueExA
shell32
ShellExecuteA
ole32
CLSIDFromProgID
oleaut32
SafeArrayPutElement
comctl32
ImageList_GetIcon
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 475KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 977KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 268KB - Virtual size: 266KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ