Behavioral task
behavioral1
Sample
97fc58ee3e96de7f807112c034f87158f524f54a6985bde8ca01b289338fe0c8.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
97fc58ee3e96de7f807112c034f87158f524f54a6985bde8ca01b289338fe0c8.exe
Resource
win10v2004-20230915-en
General
-
Target
97fc58ee3e96de7f807112c034f87158f524f54a6985bde8ca01b289338fe0c8
-
Size
6.5MB
-
MD5
a6034a136a550e7c5e4cbbbafc43518f
-
SHA1
6c66abc7f33bf8d44210ef403fb98cefb5b91a05
-
SHA256
97fc58ee3e96de7f807112c034f87158f524f54a6985bde8ca01b289338fe0c8
-
SHA512
225276135b2dc7fe4979ab0417ec7ffe06362b14bbf359f1f974e57a7d7eea4b2ea3f371a39620d4fe86bea861d79d90a54c49b1519cad6a6f10d7c06541469f
-
SSDEEP
98304:bygXxSVswOcIk01E9lwbV8WiIY5Tv6uqjhbLmUdLHhbTmdsZKqsAkV5oYM2Huxl3:OieQa+5diflSb1TmYKVD5Ev
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 97fc58ee3e96de7f807112c034f87158f524f54a6985bde8ca01b289338fe0c8
Files
-
97fc58ee3e96de7f807112c034f87158f524f54a6985bde8ca01b289338fe0c8.exe windows x86
ae1baa10a50dccbbb32ae2fe10e46599
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetVersionExW
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
WindowFromPoint
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
SetWorldTransform
advapi32
OpenServiceA
shell32
ShellExecuteW
ole32
CreateBindCtx
oleaut32
SysAllocStringLen
shlwapi
StrToIntExW
gdiplus
GdipGetPropertyItem
ws2_32
socket
iphlpapi
GetAdaptersInfo
wininet
HttpSendRequestA
psapi
GetProcessImageFileNameA
dbghelp
MiniDumpWriteDump
imm32
ImmAssociateContext
usp10
ScriptItemize
opengl32
wglGetProcAddress
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 873KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 212KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.5MB - Virtual size: 6.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ