Behavioral task
behavioral1
Sample
b3b2c109df753a5932ef2f549b7b565827b9f9ad709ab6ce957775d1a54b3c40.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
b3b2c109df753a5932ef2f549b7b565827b9f9ad709ab6ce957775d1a54b3c40.exe
Resource
win10v2004-20230915-en
General
-
Target
b3b2c109df753a5932ef2f549b7b565827b9f9ad709ab6ce957775d1a54b3c40
-
Size
2.7MB
-
MD5
d7ec3db2fa919843eeb7fb6f1b86e1c8
-
SHA1
32dbc68c5ba70f5c6812241ef4bcec75414eb817
-
SHA256
b3b2c109df753a5932ef2f549b7b565827b9f9ad709ab6ce957775d1a54b3c40
-
SHA512
40602ff37e5340041a9e45c01a4a1d00d0d5bb2c670512b9b87fdaacfe7ead8d3669622e45d1173c9936cd04dd7fbda37c7ce45c5ca26e9e16dcfe8d7b0ee340
-
SSDEEP
49152:QTmn2qIQVIhQLkkXUTmyWVkIACwUFjdXci/csGTxlcOzYse54IppX3qNMJzAHF:QTmn2qIQahQLkkXUydVkIkUtdXHriaOX
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b3b2c109df753a5932ef2f549b7b565827b9f9ad709ab6ce957775d1a54b3c40
Files
-
b3b2c109df753a5932ef2f549b7b565827b9f9ad709ab6ce957775d1a54b3c40.exe windows:4 windows x86
9149dbee7833a7392f9c44108508ed9e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamOut
ws2_32
WSAAsyncSelect
kernel32
EnumResourceNamesA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetMenu
MessageBoxA
gdi32
GetViewportExtEx
winspool.drv
OpenPrinterA
advapi32
RegOpenKeyExA
shell32
SHGetFileInfoA
ole32
CLSIDFromString
oleaut32
LoadTypeLi
comctl32
ord17
comdlg32
ChooseColorA
Sections
.text Size: - Virtual size: 506KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 208KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 616KB - Virtual size: 630KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.huzpsb Size: - Virtual size: 1.4MB
IMAGE_SCN_MEM_EXECUTE
.vmp0 Size: - Virtual size: 159KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 264B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ