?GetExeFolder@base@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@XZ
Behavioral task
behavioral1
Sample
4d6be7ceed0dcce5c540f6815b3d6a94dcd19700a7d389a5a174421db92cafb4.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
4d6be7ceed0dcce5c540f6815b3d6a94dcd19700a7d389a5a174421db92cafb4.dll
Resource
win10v2004-20230915-en
General
-
Target
4d6be7ceed0dcce5c540f6815b3d6a94dcd19700a7d389a5a174421db92cafb4
-
Size
2.7MB
-
MD5
e89eebf244a51f32d43330912e2cb7d9
-
SHA1
9259f971fd3c0641541198c120c112228177a90f
-
SHA256
4d6be7ceed0dcce5c540f6815b3d6a94dcd19700a7d389a5a174421db92cafb4
-
SHA512
a8416cf3f0a8ff11d6bf0fda3508333d2de2ddcd8d077dd38c339acb1660d8d04cdbfb505cb925703d751e48242eade4925535e65a219ab6f5df1a58c74d771f
-
SSDEEP
49152:qNMHlD1vZl/3dxkgM37xHuofzgBRJLFvYAlpI2dc0SU1yKPbJ1sHBexsOg5mf8OJ:qalD1vzj0ufB6idc0SifPbTshLxq5hhS
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4d6be7ceed0dcce5c540f6815b3d6a94dcd19700a7d389a5a174421db92cafb4
Files
-
4d6be7ceed0dcce5c540f6815b3d6a94dcd19700a7d389a5a174421db92cafb4.dll windows:6 windows x86
8b1528cc1805dca6c5ba34286aa9d3ca
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
LoadResource
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetWindowLongA
gdi32
GetViewportExtEx
msimg32
AlphaBlend
winspool.drv
DocumentPropertiesA
advapi32
RegDeleteKeyA
shell32
DragFinish
shlwapi
PathRemoveFileSpecW
uxtheme
IsThemeBackgroundPartiallyTransparent
dwmapi
DwmDefWindowProc
ole32
CoCreateInstance
oleaut32
SysAllocStringLen
oleacc
LresultFromObject
gdiplus
GdipDisposeImage
imm32
ImmGetContext
winmm
PlaySoundA
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 278KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 374KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.Cream Size: - Virtual size: 512B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp2 Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 188B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ