Behavioral task
behavioral1
Sample
b8a23b1ff3024710517ee8781724f98ed74891feeb67e7f5eb96c9f4a0b39232.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
b8a23b1ff3024710517ee8781724f98ed74891feeb67e7f5eb96c9f4a0b39232.exe
Resource
win10v2004-20230915-en
General
-
Target
b8a23b1ff3024710517ee8781724f98ed74891feeb67e7f5eb96c9f4a0b39232
-
Size
2.7MB
-
MD5
14529047ca79f75bb684a77702ee6881
-
SHA1
2ba7ce7e0f1951af63cb5e046d7fc318216dabe3
-
SHA256
b8a23b1ff3024710517ee8781724f98ed74891feeb67e7f5eb96c9f4a0b39232
-
SHA512
ddc9e1f4892c810dc4207b39196086ab3b10d101ab3a17385662d91df7b04d4a9ff34697806103daa029c227f9d1b277911a3b3b98dd686a0e9d6e462d856440
-
SSDEEP
49152:J5pu5FpdjWc79ij2I8A6s+3do4WWI14vWSXgwYRGanwkzN:J7uXjPpiResBWI14vWAgwYRmkh
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b8a23b1ff3024710517ee8781724f98ed74891feeb67e7f5eb96c9f4a0b39232
Files
-
b8a23b1ff3024710517ee8781724f98ed74891feeb67e7f5eb96c9f4a0b39232.exe windows:5 windows x86
44aa90463f5c2a5a72c8a6e50228457e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mpr
WNetCloseEnum
winmm
waveOutWrite
ws2_32
ntohl
msvfw32
DrawDibDraw
avifil32
AVIStreamInfoA
kernel32
GetVersion
GetVersionExA
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
LoadStringA
CharUpperBuffW
gdi32
Escape
msimg32
GradientFill
winspool.drv
OpenPrinterA
comdlg32
GetFileTitleA
advapi32
RegCreateKeyExA
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
tt
DragQueryFileA
ole32
CLSIDFromProgID
oleaut32
VariantCopyInd
comctl32
ImageList_Read
wldap32
ord29
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 829KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 425KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 441KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 272B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ