Behavioral task
behavioral1
Sample
c43a6db4d2232bc9c60a0b5379957188e2cafff765f1a2fb2b56222e415617db.exe
Resource
win7-20230831-en
General
-
Target
c43a6db4d2232bc9c60a0b5379957188e2cafff765f1a2fb2b56222e415617db
-
Size
2.1MB
-
MD5
51e9dd05920c1199379eaa77980cce45
-
SHA1
f781ed1f5f16bd37e61d7c5e168dc3a55e05aa5e
-
SHA256
c43a6db4d2232bc9c60a0b5379957188e2cafff765f1a2fb2b56222e415617db
-
SHA512
cd425381e575ab69fe2d8ac63815a6f88a00e4337573df0da761e486e585faf3a9cc4860d460c2ff406b7f9369b267dadae502cb5d3f3fa8ad3e519d47ffdf0a
-
SSDEEP
49152:I7T+N9hlut64Swzq82WchnDTQ6r2QAP6A0MKMIO4aR6vXVkjK8VXCKVA:ctSwzX2XDU6y0lqofVCVXCP
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c43a6db4d2232bc9c60a0b5379957188e2cafff765f1a2fb2b56222e415617db
Files
-
c43a6db4d2232bc9c60a0b5379957188e2cafff765f1a2fb2b56222e415617db.exe windows:5 windows x86
cc5e5e62862c9bf96f6d1a3309a7099b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiOutPrepareHeader
ws2_32
closesocket
version
VerLanguageNameA
rasapi32
RasHangUpA
kernel32
FreeEnvironmentStringsA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetKeyState
gdi32
CreateRectRgn
winspool.drv
DocumentPropertiesA
advapi32
GetUserNameA
shell32
Shell_NotifyIconA
ole32
OleUninitialize
oleaut32
LoadTypeLi
comctl32
ord17
wininet
InternetCloseHandle
comdlg32
ChooseColorA
Sections
.text Size: - Virtual size: 966KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 893KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 449KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 817KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ