Behavioral task
behavioral1
Sample
82a08b2cffc06794779fc031f8b08a527283f9da5387344f690d696d7573514d.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
82a08b2cffc06794779fc031f8b08a527283f9da5387344f690d696d7573514d.exe
Resource
win10v2004-20230915-en
General
-
Target
82a08b2cffc06794779fc031f8b08a527283f9da5387344f690d696d7573514d
-
Size
12.0MB
-
MD5
1caa40e26f51562c924eddcedd6ae55a
-
SHA1
4a094723a1ab7aba4e82cfda7843b94cadb30962
-
SHA256
82a08b2cffc06794779fc031f8b08a527283f9da5387344f690d696d7573514d
-
SHA512
bb79a7427b7a5b508a1119ed8dd17653b498d2cf259ca03b37a738afdd23156ad2529dfef87ae01f188a236f760c9f05671885347b56367d988e2728ac182cd1
-
SSDEEP
196608:557/zmlBncCS02/bEFm7eEfXIvCWK8pVkCf6/4F36SNMGDsmwfMw:r/SHcFfTEFmyEfXGK8IZAF37NRb5w
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 82a08b2cffc06794779fc031f8b08a527283f9da5387344f690d696d7573514d
Files
-
82a08b2cffc06794779fc031f8b08a527283f9da5387344f690d696d7573514d.exe windows:5 windows x86
1e5ff83f66a7193f7ca9e16f0ba5e667
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasHangUpA
winmm
waveOutRestart
ws2_32
connect
kernel32
GetVersionExA
GetVersion
CreateFileA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetWindowContextHelpId
gdi32
PathToRegion
winspool.drv
OpenPrinterA
advapi32
RegQueryValueA
shell32
SHGetSpecialFolderPathA
ole32
CoRevokeClassObject
oleaut32
SafeArrayGetElemsize
comctl32
ImageList_Create
oledlg
ord8
wininet
InternetCloseHandle
comdlg32
ChooseColorA
Sections
.text Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 485KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 957KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 4.5MB - Virtual size: 4.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ