Behavioral task
behavioral1
Sample
3417d73e73922ac805e4979ecbb766881e3c83daef88a29d2dccf0bc2895872d.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
3417d73e73922ac805e4979ecbb766881e3c83daef88a29d2dccf0bc2895872d.dll
Resource
win10v2004-20230703-en
General
-
Target
3417d73e73922ac805e4979ecbb766881e3c83daef88a29d2dccf0bc2895872d
-
Size
1.2MB
-
MD5
db4d556717b764701acbeb1e56721e25
-
SHA1
031401ca9a1671fce4efe0de668be98f3a7ac7f6
-
SHA256
3417d73e73922ac805e4979ecbb766881e3c83daef88a29d2dccf0bc2895872d
-
SHA512
9419a2b48b840430c291e98acaa2752b3fcd34c9dd8ce49dc9b61fb1a3d275d2662434c3418eeb0f4e9d42e71545dc7d4f054ff4c721bc7db025c18b51eafbfd
-
SSDEEP
24576:3fa38wXQ6gyvgN4ezx5vOQ47LUcyzPAqdQ+6jOR67cChjLh/bqihqlm8Yfhd:3fx61o7nvOI/6/J9Jim80d
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3417d73e73922ac805e4979ecbb766881e3c83daef88a29d2dccf0bc2895872d
Files
-
3417d73e73922ac805e4979ecbb766881e3c83daef88a29d2dccf0bc2895872d.dll windows x86
6617ad6377d7c65dcb226e46e72d9053
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ws2_32
ntohs
kernel32
SizeofResource
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
DispatchMessageW
advapi32
LookupPrivilegeValueW
shell32
ShellExecuteW
psapi
GetModuleFileNameExW
iphlpapi
SendARP
shlwapi
StrPBrkW
winmm
timeGetTime
Sections
.text Size: 257KB - Virtual size: 256KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 57KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 828KB - Virtual size: 827KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 94KB - Virtual size: 94KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 868B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ