Behavioral task
behavioral1
Sample
aca0bb8b4779b99d457d496b6677e7564a37b50575ef898dcc0ac7bf4d83412b.exe
Resource
win7-20230831-en
General
-
Target
aca0bb8b4779b99d457d496b6677e7564a37b50575ef898dcc0ac7bf4d83412b
-
Size
6.5MB
-
MD5
d82f2da75c065e9ae47f6f0426014e9b
-
SHA1
4b4fb23303046ff19ff517be850c4a4937df99b5
-
SHA256
aca0bb8b4779b99d457d496b6677e7564a37b50575ef898dcc0ac7bf4d83412b
-
SHA512
4fa6d581da6d0f9a5c045330633254aacf69425bb86dbabc68b4e1cccf4e89c11dd6b22288ffdaadf3b2e1b171b8567ba667eefa5bc12762cd4ea0fcc3bcc002
-
SSDEEP
196608:rYTfoZgRxc+VI5q2Q8OTglwrruWb4OGCIoUYIp:r2wVKIWmlw/SOGC0Y
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource aca0bb8b4779b99d457d496b6677e7564a37b50575ef898dcc0ac7bf4d83412b
Files
-
aca0bb8b4779b99d457d496b6677e7564a37b50575ef898dcc0ac7bf4d83412b.exe windows x86
f4f66e6336c64b2085efb80fa8e1e885
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutGetNumDevs
ws2_32
WSACleanup
rasapi32
RasHangUpA
kernel32
GetVersionExA
GetVersion
ReleaseMutex
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetWindow
gdi32
SetMapMode
winspool.drv
ClosePrinter
advapi32
RegQueryValueA
shell32
DragQueryFileA
ole32
CLSIDFromString
oleaut32
UnRegisterTypeLi
comctl32
ImageList_Create
wininet
InternetCloseHandle
comdlg32
GetSaveFileNameA
Sections
.text Size: - Virtual size: 926KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 509KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 6.5MB - Virtual size: 6.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ