Behavioral task
behavioral1
Sample
7929f09c3609f6bffaf629a0cfb545d754510231221fb3dd79a3413483894481.exe
Resource
win7-20230831-en
General
-
Target
7929f09c3609f6bffaf629a0cfb545d754510231221fb3dd79a3413483894481
-
Size
9.4MB
-
MD5
a76784c59ef815df27dba566881fd240
-
SHA1
8370ec24a1be8bd5b5a78b60418d27af07a8484e
-
SHA256
7929f09c3609f6bffaf629a0cfb545d754510231221fb3dd79a3413483894481
-
SHA512
3d99749cf87f13e3f25f4bd30b81eef44f389bb32ed12c5aabb4d9dc69f5d4388032c0a20d6127fd29cb4a7eaf0a4bc2c7bfed3ee5ae05972c77804af0879fb2
-
SSDEEP
196608:ez3mFkiXG7GrhcDVlvVcrON+wQ7wPbmXVUqQ02XY52knWtUKozixk7c6VdN85:ejmLN4rtcr9ARqTIY52EtziylE
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7929f09c3609f6bffaf629a0cfb545d754510231221fb3dd79a3413483894481
Files
-
7929f09c3609f6bffaf629a0cfb545d754510231221fb3dd79a3413483894481.exe windows:5 windows x86
345e8588a035bb61b738cd7ed1fa8e36
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvfw32
DrawDibDraw
avifil32
AVIStreamInfoA
winmm
midiOutUnprepareHeader
ws2_32
connect
rasapi32
RasHangUpA
kernel32
GetSystemTime
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SystemParametersInfoA
gdi32
SelectPalette
winspool.drv
OpenPrinterA
comdlg32
GetOpenFileNameA
advapi32
RegSetValueExA
shell32
SHGetPathFromIDListA
ole32
OleRun
oleaut32
SysFreeString
comctl32
ImageList_Destroy
oledlg
ord8
wininet
InternetOpenA
Sections
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 15.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 555KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 978KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 9.3MB - Virtual size: 9.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ