Behavioral task
behavioral1
Sample
42f3d892302739c48fc6596dad1917122f9bc6e641b18618aa0700f4e973068e.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
42f3d892302739c48fc6596dad1917122f9bc6e641b18618aa0700f4e973068e.exe
Resource
win10v2004-20230824-en
General
-
Target
42f3d892302739c48fc6596dad1917122f9bc6e641b18618aa0700f4e973068e
-
Size
2.8MB
-
MD5
4188d91bd4004a80ae9a7b94123970bf
-
SHA1
9435d5359149ee3c58f420b44c916fea7eaeee3b
-
SHA256
42f3d892302739c48fc6596dad1917122f9bc6e641b18618aa0700f4e973068e
-
SHA512
9a0a8254acfb627003fb17c5d496ef2f885c15c80eac60c5e79dd50dd399f51dc4a914505261e248942868f0b08054ebebaa1c85b00a8909097022d258544d29
-
SSDEEP
49152:ppaXTgsBcfILFAKzPFY59YQ7dNzgRquehIFz60wPhCQOfwfXLJrJylc8FU63:pUMUiMxY9VvZIk0wPhCQOIzJrAljX
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 42f3d892302739c48fc6596dad1917122f9bc6e641b18618aa0700f4e973068e
Files
-
42f3d892302739c48fc6596dad1917122f9bc6e641b18618aa0700f4e973068e.exe windows x86
40cbfe67b068f88237e7826b2bd3a6e3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasGetConnectStatusA
kernel32
RaiseException
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
DrawFrameControl
MessageBoxA
gdi32
GetViewportExtEx
winmm
waveOutUnprepareHeader
winspool.drv
DocumentPropertiesA
advapi32
RegQueryValueA
shell32
SHGetSpecialFolderPathA
ole32
CLSIDFromString
oleaut32
VariantClear
comctl32
ImageList_Destroy
ws2_32
closesocket
wininet
InternetCanonicalizeUrlA
comdlg32
GetOpenFileNameA
Sections
.text Size: - Virtual size: 649KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 329KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 368KB - Virtual size: 381KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 163KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ