Behavioral task
behavioral1
Sample
0fc9b32ce3d413281569d019f0d9cd712224ca7d8a8a375bfea881335142093a.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
0fc9b32ce3d413281569d019f0d9cd712224ca7d8a8a375bfea881335142093a.exe
Resource
win10v2004-20230831-en
General
-
Target
0fc9b32ce3d413281569d019f0d9cd712224ca7d8a8a375bfea881335142093a
-
Size
252KB
-
MD5
e7b77f9ccca4b2438c87def415421e55
-
SHA1
204fd901dbdd3723e54019805edfd18dd277f3c2
-
SHA256
0fc9b32ce3d413281569d019f0d9cd712224ca7d8a8a375bfea881335142093a
-
SHA512
c49c4c44dbfec33749d49ef4d4665f197c05a524bd2d69574934c575f83cfc53ce41618908e5efee844e61e62ae0e5840f0cb188dd60feb07597142f3937bdf7
-
SSDEEP
6144:2euZGKBb+7wacDG+lACeGD4weCPjkafVWcTKGev7Z:vu0Y+7lcC+lMV7CXk0KGeTZ
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0fc9b32ce3d413281569d019f0d9cd712224ca7d8a8a375bfea881335142093a
Files
-
0fc9b32ce3d413281569d019f0d9cd712224ca7d8a8a375bfea881335142093a.exe windows x86
1381df62f51b51f8ebbf89973976e530
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WideCharToMultiByte
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
oleaut32
VariantTimeToSystemTime
user32
TabbedTextOutA
MessageBoxA
gdi32
SetWindowExtEx
advapi32
RegDeleteValueA
winspool.drv
OpenPrinterA
comctl32
ord17
rasapi32
RasGetConnectStatusA
wsock32
WSAStartup
wininet
InternetCanonicalizeUrlA
shell32
ShellExecuteA
Sections
.text Size: - Virtual size: 169KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 185KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 73KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 220KB - Virtual size: 218KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 128B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ