Behavioral task
behavioral1
Sample
0c0698da7fe5bc7068fc6f60fdc087e95d69b19562bc06f9b3cdd9c6056c15cb.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
0c0698da7fe5bc7068fc6f60fdc087e95d69b19562bc06f9b3cdd9c6056c15cb.exe
Resource
win10v2004-20230915-en
General
-
Target
0c0698da7fe5bc7068fc6f60fdc087e95d69b19562bc06f9b3cdd9c6056c15cb
-
Size
3.9MB
-
MD5
9b8cc2e28fcaf29d28c20dd581187713
-
SHA1
fc2eafa7084c5a8f76a786e74a177ff6b7f24a49
-
SHA256
0c0698da7fe5bc7068fc6f60fdc087e95d69b19562bc06f9b3cdd9c6056c15cb
-
SHA512
aca9fcb260961dd92cf84499529f2189748cf2cc46275d50e5a7120251e566362c06590f4c6fb0dafd13bb22a3da8277c5a82be33f7e58519eaa83cd125090ac
-
SSDEEP
98304:hf1zf90Td9K77EawUpX3nSEovnhMoCPvIH+QduI:VZSTDj7Ux3SZnqFHIVd
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0c0698da7fe5bc7068fc6f60fdc087e95d69b19562bc06f9b3cdd9c6056c15cb
Files
-
0c0698da7fe5bc7068fc6f60fdc087e95d69b19562bc06f9b3cdd9c6056c15cb.exe windows x86
700507892f6d8c0af8adf49542c049ea
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamOut
ws2_32
socket
rasapi32
RasHangUpA
kernel32
LoadLibraryExA
user32
ClientToScreen
gdi32
ExtSelectClipRgn
msimg32
GradientFill
winspool.drv
OpenPrinterA
advapi32
RegQueryValueExA
shell32
Shell_NotifyIconA
ole32
CLSIDFromProgID
oleaut32
LoadTypeLi
comctl32
ImageList_GetIcon
wininet
InternetCanonicalizeUrlA
comdlg32
ChooseFontA
msvcrt
strncpy
iphlpapi
GetInterfaceInfo
psapi
GetMappedFileNameW
Sections
.text Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sedata Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.sedata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: 4KB - Virtual size: 256B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE