Behavioral task
behavioral1
Sample
cDrNxaqBQk.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
cDrNxaqBQk.exe
Resource
win10v2004-20230915-en
General
-
Target
cDrNxaqBQk.exe
-
Size
6.0MB
-
MD5
c35b58e9d6950587402e14e8ee4a0bc3
-
SHA1
2f3dc3b0752b21af332124e89c41e700ae61f7a4
-
SHA256
6a17b6290fa59c5ea289310d5a303442a087f8da0455a1de8204ac0a712dfbb0
-
SHA512
9f50d4c7b0d5092278c81b943ba664b161c8ac950ff56e58ef1defdb5b74040993bfabe071ca4ed580a9a6a9a28e25b05ca9774a1b1a056f797cdb261401ee7b
-
SSDEEP
196608:2Wi0hdRT+2CUryMFp8C41GY2hPtBheUTyRo:li0vRMohL8fG7hP7Aiyu
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cDrNxaqBQk.exe
Files
-
cDrNxaqBQk.exe.exe windows x64
86f46db29a0561f1a0f20ffeb8c61331
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
dbghelp
ImageNtHeader
kernel32
DecodePointer
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
ws2_32
recv
advapi32
ConvertSidToStringSidA
user32
GetAsyncKeyState
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
ntdll
RtlCaptureContext
userenv
UnloadUserProfile
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 462KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 183KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 8.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.0MB - Virtual size: 6.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ