Behavioral task
behavioral1
Sample
7d28e9416b4393fd8f932051922b17dd6069959d64e6ce897d0d7d85f61a5efa.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
7d28e9416b4393fd8f932051922b17dd6069959d64e6ce897d0d7d85f61a5efa.exe
Resource
win10v2004-20230915-en
General
-
Target
7d28e9416b4393fd8f932051922b17dd6069959d64e6ce897d0d7d85f61a5efa
-
Size
4.1MB
-
MD5
bbe6f554765edb8331546cb2e283a001
-
SHA1
4517ef5533a067b107622d2ac8f2c77a5b8fd1f6
-
SHA256
7d28e9416b4393fd8f932051922b17dd6069959d64e6ce897d0d7d85f61a5efa
-
SHA512
6ce5192395a1a03ef7848e77e56c8e36642561a1b0ca2ce5cea0a9afec03b6ffbb91c5fe0fa5458629d3df8c12d01eb284e47e8927df2414a63aa56593041407
-
SSDEEP
49152:eQ3w50TYegepcTmb7brOKn7OxMz0acO/2Ne1zVQk:e3eMdTmfb6K6xMIauKzV
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7d28e9416b4393fd8f932051922b17dd6069959d64e6ce897d0d7d85f61a5efa
Files
-
7d28e9416b4393fd8f932051922b17dd6069959d64e6ce897d0d7d85f61a5efa.exe windows x86
343afad1bb61bc01394b4c17f3d7bbdb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CompareStringW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
advapi32
CheckTokenMembership
ole32
CoInitializeEx
Sections
.text Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 308KB - Virtual size: 307KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 259KB - Virtual size: 259KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 45KB - Virtual size: 45KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 308KB - Virtual size: 307KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ