Behavioral task
behavioral1
Sample
59fd068415ea72a2d7ca4e5382e8d4554fa3746e24ea341b0d3de33e1f97f484.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
59fd068415ea72a2d7ca4e5382e8d4554fa3746e24ea341b0d3de33e1f97f484.exe
Resource
win10v2004-20230915-en
General
-
Target
59fd068415ea72a2d7ca4e5382e8d4554fa3746e24ea341b0d3de33e1f97f484
-
Size
1.3MB
-
MD5
c10abe65945a2e7be3d7fec2bbfaa90a
-
SHA1
795c42a5b648849262d603db329f8d4a39726c7f
-
SHA256
59fd068415ea72a2d7ca4e5382e8d4554fa3746e24ea341b0d3de33e1f97f484
-
SHA512
ae37ad4ea990dc6912303a6f40e90fe370e64f20f9fd02f1511fdeee702873ff344d49331d0131b54d290d3b5195242a48d5af923633195e297ac40ddd376eb7
-
SSDEEP
24576:vlHj1RjMjLSFn/A1yggW/eLPqN+9do6jASWnW6N9Z8NsI6YPeb6l:vRrjQ4nTbPqNkASWnWIaNGYPe
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 59fd068415ea72a2d7ca4e5382e8d4554fa3746e24ea341b0d3de33e1f97f484
Files
-
59fd068415ea72a2d7ca4e5382e8d4554fa3746e24ea341b0d3de33e1f97f484.exe windows:5 windows x86
bd4e4791893acaa6c974117fe48884c2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetVersion
EnumResourceLanguagesA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
EnumDisplaySettingsA
gdi32
StartDocA
winmm
midiOutReset
winspool.drv
ClosePrinter
advapi32
RegCloseKey
shell32
ShellExecuteA
ole32
OleInitialize
oleaut32
SysAllocString
comctl32
ord17
ws2_32
getpeername
comdlg32
GetSaveFileNameA
Sections
.text Size: - Virtual size: 673KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 303KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.awang Size: - Virtual size: 200B
IMAGE_SCN_MEM_EXECUTE
.vmp1 Size: - Virtual size: 874KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ