Behavioral task
behavioral1
Sample
f548488ca2c66c945270ff6d20d4c2e4a639644d739ab2952a2ca3e7d4dbc88a.exe
Resource
win7-20230831-en
General
-
Target
f548488ca2c66c945270ff6d20d4c2e4a639644d739ab2952a2ca3e7d4dbc88a
-
Size
13.4MB
-
MD5
8673a0675ae27171f6efa272737e2028
-
SHA1
a14c07eba6557c9aac984a987e1675830f65762f
-
SHA256
f548488ca2c66c945270ff6d20d4c2e4a639644d739ab2952a2ca3e7d4dbc88a
-
SHA512
18c21c6d3bbb2948fd831947e0f9183ff2081c6a3a593f458966cc550300f42a54a810884c2bcbe877ba823f8a0a1344768cf4d293dc221e2ab2e4a72350b713
-
SSDEEP
393216:2p5fNGXXR15cbiF4l5FJvfIsuVoy+xFrQ1HYRCpU:65Q8iF4HvfInVo9Pr+HYeU
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f548488ca2c66c945270ff6d20d4c2e4a639644d739ab2952a2ca3e7d4dbc88a
Files
-
f548488ca2c66c945270ff6d20d4c2e4a639644d739ab2952a2ca3e7d4dbc88a.exe windows x86
9bc1cec08643934766ac4c6986cac95e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
TlsSetValue
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
crypt32
CryptBinaryToStringA
user32
CreateDialogIndirectParamA
rasapi32
RasDialA
iphlpapi
GetAdaptersInfo
winmm
midiOutPrepareHeader
ws2_32
send
msvfw32
DrawDibDraw
avifil32
AVIStreamGetFrame
rpcrt4
RpcStringFreeA
gdi32
RealizePalette
msimg32
GradientFill
winspool.drv
DocumentPropertiesA
comdlg32
GetOpenFileNameA
advapi32
RegQueryValueA
shell32
DragAcceptFiles
ole32
CoTaskMemAlloc
oleaut32
OleCreateFontIndirect
odbc32
ord16
comctl32
ImageList_DragMove
oledlg
ord8
wininet
InternetOpenA
wldap32
ord29
Sections
.text Size: - Virtual size: 4.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 12.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 752KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 13.2MB - Virtual size: 13.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 268KB - Virtual size: 266KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ