Behavioral task
behavioral1
Sample
6d4bc1c35b5e1acc5c073941d49a7467fb2d9c53272ae43cb56799cb6cc7b575.exe
Resource
win7-20230824-en
General
-
Target
6d4bc1c35b5e1acc5c073941d49a7467fb2d9c53272ae43cb56799cb6cc7b575
-
Size
14.0MB
-
MD5
fce0e8e8de8116d48ac0f4dca85cd5a3
-
SHA1
80bd7706ef00c1d8d9d045ac536ea10290931247
-
SHA256
6d4bc1c35b5e1acc5c073941d49a7467fb2d9c53272ae43cb56799cb6cc7b575
-
SHA512
af5cf4cc3d5616b928241005eabafbf97241275d5717f6140f5fe1b6fb782db6674a96e64d09c755f1651624324e74690b30234f60f399982ef1f94daf0a376d
-
SSDEEP
393216:HIWDsyrH+5QgNxCEEPOxLyjAqkIa2Vm+im7:7zrHYJBw0qkIpVH
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6d4bc1c35b5e1acc5c073941d49a7467fb2d9c53272ae43cb56799cb6cc7b575
Files
-
6d4bc1c35b5e1acc5c073941d49a7467fb2d9c53272ae43cb56799cb6cc7b575.exe windows x86
28ce216c9b329e7ea5a95d3a19fee174
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutRestart
ws2_32
gethostname
msvfw32
DrawDibDraw
avifil32
AVIStreamInfoA
rasapi32
RasHangUpA
kernel32
GetVersion
GetVersionExA
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetMenuState
CharUpperBuffW
gdi32
GetTextMetricsA
winspool.drv
OpenPrinterA
comdlg32
GetFileTitleA
advapi32
RegCreateKeyExA
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
shell32
SHGetSpecialFolderPathA
ole32
CLSIDFromProgID
oleaut32
RegisterTypeLi
comctl32
ImageList_Destroy
wsock32
getservbyname
wininet
InternetCloseHandle
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 4.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 10.0MB - Virtual size: 10.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 292B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ