Behavioral task
behavioral1
Sample
c27f53eec185a90ddf4dcd3d171557d0c6ab39c98cf634894fded2c735e7ed36.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
c27f53eec185a90ddf4dcd3d171557d0c6ab39c98cf634894fded2c735e7ed36.dll
Resource
win10v2004-20230915-en
General
-
Target
972301fd39458442b2b7592ed059f3f6.bin
-
Size
333KB
-
MD5
78b57cca070160aefcc9e7581111292a
-
SHA1
052547242c3d98dcf44adedcfd4aec12ae734ea9
-
SHA256
6575698bf8b97a1ca0e49441e3beaf73fcfaf4e9881f076058251372316f8a27
-
SHA512
6b452f49af6a226b3159364c5e14836af82f09b0976f7a68e7f7fe6f582bfdd379b3f0825d72cae0ce3842becf5003b8f20165b722e69dd4f2bc6222d5c164ad
-
SSDEEP
6144:FlT+KUUb/Y4Ry5ACL47LKIyvJWxR4Lj/eM9l2aIM6n/rebcZuZ2C:LTQzr5dLMLK3ceLp2aIMmTkkC
Malware Config
Signatures
-
resource yara_rule static1/unpack001/c27f53eec185a90ddf4dcd3d171557d0c6ab39c98cf634894fded2c735e7ed36.dll vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/c27f53eec185a90ddf4dcd3d171557d0c6ab39c98cf634894fded2c735e7ed36.dll
Files
-
972301fd39458442b2b7592ed059f3f6.bin.zip
Password: infected
-
c27f53eec185a90ddf4dcd3d171557d0c6ab39c98cf634894fded2c735e7ed36.dll.dll windows:4 windows x86
Password: infected
827b58f07b1e0ce69d050c12881a4841
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
ExitProcess
GetModuleHandleA
lstrcmpiA
CreateFileA
WaitForSingleObject
CreateThread
Sleep
CopyFileA
lstrcatA
lstrlenA
GetModuleFileNameA
DeleteFileA
GetWindowsDirectoryA
DisableThreadLibraryCalls
lstrcpyA
lstrcpynA
ReadFile
GetFileSize
DeviceIoControl
LoadLibraryA
GetVersionExA
GetTickCount
MultiByteToWideChar
WideCharToMultiByte
lstrlenW
LocalAlloc
SetFileTime
GetFileTime
Module32Next
Module32First
Process32Next
Process32First
CreateToolhelp32Snapshot
OpenProcess
VirtualProtect
GetLastError
WriteFile
LoadResource
SizeofResource
FindResourceA
LoadLibraryW
GetVersion
WritePrivateProfileStringA
GetPrivateProfileSectionA
GetPrivateProfileSectionNamesA
WritePrivateProfileSectionA
GetPrivateProfileStringA
SuspendThread
Thread32Next
Thread32First
ResumeThread
InitializeCriticalSectionAndSpinCount
CreateIoCompletionPort
InterlockedExchangeAdd
PostQueuedCompletionStatus
InterlockedExchange
GetQueuedCompletionStatus
SetLastError
InterlockedCompareExchange
InterlockedDecrement
SetWaitableTimer
InterlockedIncrement
SetEvent
CreateEventA
TlsGetValue
TlsSetValue
HeapFree
GetProcessHeap
QueueUserAPC
TerminateThread
WaitForMultipleObjects
SleepEx
HeapAlloc
TlsAlloc
TlsFree
FormatMessageA
GetSystemTimeAsFileTime
CreateWaitableTimerA
SystemTimeToFileTime
ResetEvent
OpenEventA
GetCurrentProcessId
GetProcAddress
GetCurrentProcess
lstrcmpA
ReadProcessMemory
VirtualQueryEx
VirtualProtectEx
CloseHandle
DeleteCriticalSection
FreeLibrary
GetSystemDirectoryA
InitializeCriticalSection
LocalFree
user32
UnhookWindowsHookEx
SetTimer
SetWindowsHookExA
wsprintfA
CallNextHookEx
GetWindowThreadProcessId
PostQuitMessage
advapi32
AdjustTokenPrivileges
AllocateAndInitializeSid
OpenProcessToken
GetTokenInformation
InitializeAcl
AddAccessDeniedAce
AddAccessAllowedAce
SetSecurityInfo
FreeSid
LookupPrivilegeValueA
msvcr71
__CppXcptFilter
_adjust_fdiv
malloc
_initterm
free
?terminate@@YAXXZ
_onexit
__dllonexit
atoi
memcmp
vsprintf
??0exception@@QAE@ABQBD@Z
_beginthreadex
??_U@YAPAXI@Z
??8type_info@@QBEHABV0@@Z
?what@exception@@UBEPBDXZ
_except_handler3
??0exception@@QAE@XZ
??1exception@@UAE@XZ
??_V@YAXPAX@Z
_purecall
strtol
_mbsrev
_mbschr
_mbsstr
strcpy
_mbsicmp
_mbscmp
strtod
strtoul
_strdup
srand
rand
_CxxThrowException
??0exception@@QAE@ABV0@@Z
exit
strlen
_mbsnbcpy
__CxxFrameHandler
sprintf
strncpy
??3@YAXPAX@Z
gmtime
strerror
memset
memcpy
wcsstr
??2@YAPAXI@Z
??1type_info@@UAE@XZ
msvcp71
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIABV12@@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??7ios_base@std@@QBE_NXZ
?eof@ios_base@std@@QBE_NXZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADH@Z
?gcount@?$basic_istream@DU?$char_traits@D@std@@@std@@QBEHXZ
?close@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?max@?$numeric_limits@I@std@@SAIXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
shlwapi
StrStrIA
psapi
EnumProcessModules
GetModuleFileNameExA
EnumProcesses
ws2_32
select
WSARecv
__WSAFDIsSet
listen
bind
getsockname
getsockopt
inet_addr
connect
WSASocketA
setsockopt
freeaddrinfo
WSAGetLastError
getaddrinfo
shutdown
WSASend
WSASetLastError
ioctlsocket
closesocket
WSACleanup
accept
WSAStartup
Sections
.text Size: 136KB - Virtual size: 134KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 164KB - Virtual size: 163KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ