Behavioral task
behavioral1
Sample
e8388e961a4d4f0f363a452839dda8f2920a40cf96283393d337da8caead99f3.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
e8388e961a4d4f0f363a452839dda8f2920a40cf96283393d337da8caead99f3.exe
Resource
win10v2004-20230915-en
General
-
Target
e8388e961a4d4f0f363a452839dda8f2920a40cf96283393d337da8caead99f3
-
Size
2.8MB
-
MD5
09384aefb49d2bd7986791f41316675e
-
SHA1
aa05b16d67db7c9d5d47194867db49fec5859d22
-
SHA256
e8388e961a4d4f0f363a452839dda8f2920a40cf96283393d337da8caead99f3
-
SHA512
17a8aab9b78861ea0e4af4024c841ee5f3862e8027b389a52f0d0346699d04d86df0dce5b9041cecf753d9bd01893e49572ad20171c9f29f27c557797cb1c70e
-
SSDEEP
49152:KwKTKZiX/O4uhCkGW914Df0NCB4lVXzuuE1gHxREMoVfxIH:KluZiXWl7GONCoXzegRxH
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e8388e961a4d4f0f363a452839dda8f2920a40cf96283393d337da8caead99f3
Files
-
e8388e961a4d4f0f363a452839dda8f2920a40cf96283393d337da8caead99f3.exe windows:5 windows x86
c995c57c7f88f96438ab545c4a6b1d67
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegCreateKeyExA
kernel32
LockFile
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetCapture
gdi32
GetStockObject
comdlg32
GetFileTitleA
winspool.drv
OpenPrinterA
shell32
ShellExecuteExA
shlwapi
PathIsUNCA
oledlg
ord8
ole32
CoTaskMemAlloc
oleaut32
VariantChangeType
wininet
InternetOpenA
Sections
.text Size: 236KB - Virtual size: 236KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 56KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.B7A6CFE Size: 4B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 682KB - Virtual size: 682KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 858KB - Virtual size: 858KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ