Behavioral task
behavioral1
Sample
Setup-Main.exe
Resource
win7-20230831-en
General
-
Target
Setup-Main.exe.vir
-
Size
6.8MB
-
MD5
c364d169c48a8f4c35f7c7ad9eb03a6f
-
SHA1
8f874961d4092bd8fbd69711187842cef5ae1fb1
-
SHA256
6443000933b98e293ec5842cd71149fe1506a80dd5eed08b41e1949222f71e69
-
SHA512
313396198cf8b0fe3adbae26f48107646f317d62e7e4ff7fe4f05da58c8257d597d5f8943c165a62a41c53e01ac96d1a584aad0ce99781452e047d3cd8bfddb1
-
SSDEEP
196608:gFudNLJsRNyyIYA1EHeU8ZJ5yVPve8Is/AdpPl:vvVs/ydY8o2QV3fZIdB
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Setup-Main.exe.vir
Files
-
Setup-Main.exe.vir.exe windows x86
6f1afb521158f9e8201d86952c5e32ca
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EnumDisplayDevicesA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
GetCurrentHwProfileW
gdi32
BitBlt
shlwapi
PathFileExistsW
winhttp
WinHttpCloseHandle
iphlpapi
GetAdaptersInfo
wininet
InternetQueryDataAvailable
crypt32
CryptStringToBinaryA
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 418KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.2MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 625KB - Virtual size: 624KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ