Behavioral task
behavioral1
Sample
37f7034dc17ec733acce2ef2f4c7df58e183070fd51905f8746f9fd8ad5cb9da.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
37f7034dc17ec733acce2ef2f4c7df58e183070fd51905f8746f9fd8ad5cb9da.dll
Resource
win10v2004-20230703-en
General
-
Target
37f7034dc17ec733acce2ef2f4c7df58e183070fd51905f8746f9fd8ad5cb9da
-
Size
1.2MB
-
MD5
cfccf7980b08dc645e1cd97ba73f93d1
-
SHA1
2141dae5895c2ac07b3797be587dd9c029180475
-
SHA256
37f7034dc17ec733acce2ef2f4c7df58e183070fd51905f8746f9fd8ad5cb9da
-
SHA512
817bdded7bbf85b4ce70a252c0cb03fa59c17ee086bb737b3b83ab14f7932493c642f8ac95db18978db860dd484f84224df1ba8bac4a05adbb2bde532a5efc5f
-
SSDEEP
24576:3fa38wXQ6gyvgN4ezx5vOQ47LUcyzPAqdQ+6jOR67cChjLh/bqihqlm8Yfhd:3fx61o7nvOI/6/J9Jim80d
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 37f7034dc17ec733acce2ef2f4c7df58e183070fd51905f8746f9fd8ad5cb9da
Files
-
37f7034dc17ec733acce2ef2f4c7df58e183070fd51905f8746f9fd8ad5cb9da.dll windows x86
6617ad6377d7c65dcb226e46e72d9053
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ws2_32
ntohs
kernel32
SizeofResource
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
DispatchMessageW
advapi32
LookupPrivilegeValueW
shell32
ShellExecuteW
psapi
GetModuleFileNameExW
iphlpapi
SendARP
shlwapi
StrPBrkW
winmm
timeGetTime
Sections
.text Size: 257KB - Virtual size: 256KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 57KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 828KB - Virtual size: 827KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 94KB - Virtual size: 94KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 868B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ