Behavioral task
behavioral1
Sample
9a5b82e6481569e2e44c6909664cb37df782c53081252a44a06583886c309611.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
9a5b82e6481569e2e44c6909664cb37df782c53081252a44a06583886c309611.exe
Resource
win10v2004-20230915-en
General
-
Target
9a5b82e6481569e2e44c6909664cb37df782c53081252a44a06583886c309611
-
Size
1.9MB
-
MD5
88262db481e20d950fa550d350d6a8ea
-
SHA1
ab08339ab4683dd567bca4e8a52317689acd8573
-
SHA256
9a5b82e6481569e2e44c6909664cb37df782c53081252a44a06583886c309611
-
SHA512
207abfcf959fe5c1cf0b489bab71889033c266d5b2b31ecbece3865a6c7287156cdd4f3e9222856f9aaa72ad9d091309b776d9c84983faffde3301ddb8bc15cd
-
SSDEEP
49152:8G5HIis5QXHqLXXg958J5+BieHNY1ZRjGmC8FttTWXHt:86HFs5Af956+BiCNYfXC8FPeH
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9a5b82e6481569e2e44c6909664cb37df782c53081252a44a06583886c309611
Files
-
9a5b82e6481569e2e44c6909664cb37df782c53081252a44a06583886c309611.exe windows x86
96dd632022ce60aff8d3bb0ef6a3ef9f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutOpen
ws2_32
ioctlsocket
rasapi32
RasGetConnectStatusA
kernel32
GetVersionExA
GetVersion
VirtualFree
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetForegroundWindow
gdi32
GetDIBits
winspool.drv
OpenPrinterA
advapi32
RegSetValueExA
shell32
Shell_NotifyIconA
ole32
OleInitialize
oleaut32
UnRegisterTypeLi
comctl32
ImageList_Destroy
wininet
InternetSetOptionA
comdlg32
GetFileTitleA
Sections
.text Size: - Virtual size: 554KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 244KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1009KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ