Behavioral task
behavioral1
Sample
acf4d01a24a6d8c9d16beaa57076caacabc97168e95128a941ef9179769c6c6b.exe
Resource
win7-20230831-en
General
-
Target
acf4d01a24a6d8c9d16beaa57076caacabc97168e95128a941ef9179769c6c6b
-
Size
5.9MB
-
MD5
50974dcbb9f6b97ef2f3036553ff634c
-
SHA1
2b60e7bf87c6dcb4a62791cb2381086f12ea9246
-
SHA256
acf4d01a24a6d8c9d16beaa57076caacabc97168e95128a941ef9179769c6c6b
-
SHA512
3139cd30d6982639f1ad113c9778416868d5711b002164ca5092851919196d0e29e6aeed8e0fe8ce8023c03cafc6e825a0644163f172fa9b25f9ac90cc972817
-
SSDEEP
98304:+7/i2IUW5Qfb4jQ5agA3mOIFudb9IdIvKiewUb0rsjRm3Wwxg:+7cPQj4GagPOIo59Id5cJrsk
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource acf4d01a24a6d8c9d16beaa57076caacabc97168e95128a941ef9179769c6c6b
Files
-
acf4d01a24a6d8c9d16beaa57076caacabc97168e95128a941ef9179769c6c6b.exe windows x86
e15b7619a141c0212fecd90c247af861
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvfw32
DrawDibDraw
avifil32
AVIStreamInfoA
rasapi32
RasGetConnectStatusA
kernel32
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetClassNameA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
SaveDC
winmm
waveOutReset
winspool.drv
DocumentPropertiesA
comdlg32
GetFileTitleA
advapi32
RegCreateKeyExA
shell32
DragQueryFileA
ole32
OleRun
oleaut32
UnRegisterTypeLi
comctl32
ImageList_GetImageCount
ws2_32
sendto
wldap32
ord29
wininet
InternetCloseHandle
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 994KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 476KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.9MB - Virtual size: 5.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ