Behavioral task
behavioral1
Sample
bbf47b13b41b4ff596f4939a5bc408e89c3113cc455edc37b957ad07e2f91d22.exe
Resource
win7-20230831-en
General
-
Target
bbf47b13b41b4ff596f4939a5bc408e89c3113cc455edc37b957ad07e2f91d22
-
Size
3.6MB
-
MD5
b93a40af3f59ae5f937daf966e081f48
-
SHA1
a731800c369383a37d53fec056e6c8cd8124ac3f
-
SHA256
bbf47b13b41b4ff596f4939a5bc408e89c3113cc455edc37b957ad07e2f91d22
-
SHA512
5caa17b38204b053142081e7f14c7744926b52f8525240a60154dcd676efedbb6671cc3d751866bf56130322bce1937d75a8b4b70f9a65c8c84854f8b08fed03
-
SSDEEP
98304:yri5AvP/Nny5K5cPgfVEmihzUI9y0YysWvn1ed7ol+:yOyn4eGRhzUIsO4dV
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bbf47b13b41b4ff596f4939a5bc408e89c3113cc455edc37b957ad07e2f91d22
Files
-
bbf47b13b41b4ff596f4939a5bc408e89c3113cc455edc37b957ad07e2f91d22.exe windows x86
d43b9cf602c7b0b583f8915d6ae4acbe
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetVersion
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
wsprintfA
CharUpperBuffW
gdi32
CreateFontA
winmm
midiStreamRestart
winspool.drv
ClosePrinter
advapi32
RegOpenKeyA
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
shell32
ShellExecuteA
ole32
CLSIDFromString
oleaut32
UnRegisterTypeLi
comctl32
ord17
ws2_32
ioctlsocket
comdlg32
ChooseColorA
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 647KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 553KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 231KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 568KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.maopo Size: - Virtual size: 1.0MB
IMAGE_SCN_MEM_EXECUTE
.vmp1 Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 280B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 552KB - Virtual size: 551KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ