Behavioral task
behavioral1
Sample
508f8c288d77c3260de63c7a96621f270bb6ac373038ba6e4251924125aa7fce.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
508f8c288d77c3260de63c7a96621f270bb6ac373038ba6e4251924125aa7fce.exe
Resource
win10v2004-20230915-en
General
-
Target
508f8c288d77c3260de63c7a96621f270bb6ac373038ba6e4251924125aa7fce
-
Size
13.3MB
-
MD5
90babc9dcc2b90d9a59d1813a8a48993
-
SHA1
f3d51247963dcce36569365af03c0baa7f227235
-
SHA256
508f8c288d77c3260de63c7a96621f270bb6ac373038ba6e4251924125aa7fce
-
SHA512
4ca1f1037ad8fe161eea904a52580d40157bf7e93f1cff0773edfa3426afd53901d2c8afae364ec823782f8ae0a6fcc0fe07e220a8d994786b66032f6df01c9b
-
SSDEEP
393216:8pKMAN5nNa/PP29ku67HvxQVd7ETg6ffUXgcCpzmP10:XMANz0H26u67ql3XgZV
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 508f8c288d77c3260de63c7a96621f270bb6ac373038ba6e4251924125aa7fce
Files
-
508f8c288d77c3260de63c7a96621f270bb6ac373038ba6e4251924125aa7fce.exe windows:5 windows x86
3facef52ec00abbfe318e6530bd16cbe
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutPrepareHeader
ws2_32
htonl
msvfw32
DrawDibDraw
avifil32
AVIStreamInfoA
rasapi32
RasGetConnectStatusA
rpcrt4
UuidToStringA
kernel32
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
AdjustWindowRectEx
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetROP2
msimg32
GradientFill
winspool.drv
OpenPrinterA
comdlg32
GetFileTitleA
advapi32
RegCreateKeyExA
shell32
DragQueryFileA
ole32
CoRevokeClassObject
oleaut32
OleCreateFontIndirect
comctl32
ImageList_Add
oledlg
ord8
wininet
InternetConnectA
wldap32
ord29
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 40.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 761KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 13.3MB - Virtual size: 13.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ