test
Behavioral task
behavioral1
Sample
4da25271585d7bea37cd91eb1d813dcb5497822d5c8d4afaa08ca0e1523142d9.dll
Resource
win7-20230824-en
General
-
Target
4da25271585d7bea37cd91eb1d813dcb5497822d5c8d4afaa08ca0e1523142d9
-
Size
15.6MB
-
MD5
8c592c0ff48ac10edaf10693f17a6c77
-
SHA1
1a5379d5fb676b1f7eb2594010eb3350efa0d26d
-
SHA256
4da25271585d7bea37cd91eb1d813dcb5497822d5c8d4afaa08ca0e1523142d9
-
SHA512
c8332c450fd2494fa165e2373f5a78d9eee6eb883e98698b0353a2833fec8f3a3198da89ce9ce0e7221ddaab1ce6af5cd90e8915299d700472cbdd4b40bcd545
-
SSDEEP
393216:/o5WMUdhpwcYezrpDMTUaHKBoMSR94F5GB87YBQn:/tMChpJYQpoLKBoMSRyFO87YBm
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4da25271585d7bea37cd91eb1d813dcb5497822d5c8d4afaa08ca0e1523142d9
Files
-
4da25271585d7bea37cd91eb1d813dcb5497822d5c8d4afaa08ca0e1523142d9.dll windows x86
d8fa22910f531a4c2b3538254346a495
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
winmm
waveOutRestart
ws2_32
recv
msvfw32
DrawDibDraw
avifil32
AVIStreamInfoA
kernel32
GetVersionExA
GetVersion
RaiseException
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
RegisterClipboardFormatA
gdi32
SetROP2
winspool.drv
OpenPrinterA
comdlg32
GetOpenFileNameA
advapi32
RegQueryValueA
shell32
ShellExecuteA
ole32
OleUninitialize
oleaut32
LoadTypeLi
comctl32
ord17
Exports
Exports
Sections
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 403KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 11.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 15.6MB - Virtual size: 15.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 12KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ