Behavioral task
behavioral1
Sample
e9212a2bdfc3e0d70ed7f210bd730a416155d9b5977e20d96241c21153e83ac2.exe
Resource
win7-20230712-en
General
-
Target
e9212a2bdfc3e0d70ed7f210bd730a416155d9b5977e20d96241c21153e83ac2
-
Size
2.9MB
-
MD5
ea8489a35bcc4bbe3629d99121372344
-
SHA1
587dd7fbf66f4802ba8650aec2fdbf98c05e52c6
-
SHA256
e9212a2bdfc3e0d70ed7f210bd730a416155d9b5977e20d96241c21153e83ac2
-
SHA512
9f3443a1f2305025c935ea23661a39edb53f059e45a573009e26f4399d2a8c38f32c1dcedf9ea35f50000aeb1d044eb12aede27363dddccdb3a5234f42c026be
-
SSDEEP
49152:RVFzpCCG/jEFQLhLCcYWmkYnnEkNuTqQbrwSA/x5KaFm8eM:RNeoeLtCn7jnEDTqArwxhgv
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e9212a2bdfc3e0d70ed7f210bd730a416155d9b5977e20d96241c21153e83ac2
Files
-
e9212a2bdfc3e0d70ed7f210bd730a416155d9b5977e20d96241c21153e83ac2.exe windows x86
a2fde155359a9e12974e031282876471
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvfw32
DrawDibDraw
avifil32
AVIStreamGetFrame
winmm
midiOutUnprepareHeader
ws2_32
WSAStartup
rasapi32
RasHangUpA
kernel32
GetVersionExA
GetVersion
GetModuleHandleW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
RegisterWindowMessageA
gdi32
ExtCreateRegion
msimg32
GradientFill
winspool.drv
OpenPrinterA
comdlg32
GetSaveFileNameW
advapi32
RegOpenKeyExA
shell32
ShellExecuteA
ole32
CLSIDFromString
oleaut32
SysAllocString
comctl32
ImageList_AddMasked
wininet
InternetCloseHandle
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 936KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 562KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 268KB - Virtual size: 266KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ