Behavioral task
behavioral1
Sample
8e14cbdb0c0a548ded8282c6603bc85c1de9fa610e4e4306fa836a54a60070ca.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
8e14cbdb0c0a548ded8282c6603bc85c1de9fa610e4e4306fa836a54a60070ca.exe
Resource
win10v2004-20230915-en
General
-
Target
8e14cbdb0c0a548ded8282c6603bc85c1de9fa610e4e4306fa836a54a60070ca
-
Size
2.3MB
-
MD5
6afb102b8569e74ee3e24fd5d87091d5
-
SHA1
32613ddde489b2e27a4a6e32d4275d0d91672b37
-
SHA256
8e14cbdb0c0a548ded8282c6603bc85c1de9fa610e4e4306fa836a54a60070ca
-
SHA512
95c202d681f955dbcfb928fdda9d1394a43955ed712cf2226a6f92652b58e835688b4a68dbcc8e4667889a5a15c5f8d5796e61903cff7b12693a052c94351fdb
-
SSDEEP
49152:zbbizQkIhuZQ2tTLFgiLVGJKrDk1WDXnZxPafDGGGQh:zqzpZQ2tTLFPGJ8gIXnSrGG
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8e14cbdb0c0a548ded8282c6603bc85c1de9fa610e4e4306fa836a54a60070ca
Files
-
8e14cbdb0c0a548ded8282c6603bc85c1de9fa610e4e4306fa836a54a60070ca.exe windows:5 windows x86
a9abdef33b21ee5fc8c177fab6a2c07a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasGetConnectStatusA
kernel32
GetVersion
GetVersionExA
InterlockedDecrement
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
ModifyMenuA
gdi32
EndDoc
winmm
waveOutClose
winspool.drv
DocumentPropertiesA
comdlg32
GetOpenFileNameA
advapi32
RegSetValueExA
shell32
ShellExecuteA
ole32
OleInitialize
oleaut32
SafeArrayGetUBound
comctl32
ord17
ws2_32
recvfrom
wininet
InternetCloseHandle
Sections
.text Size: - Virtual size: 666KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 259KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ