Behavioral task
behavioral1
Sample
ebc0a23966c792adccd685ca6b844ddfdd41cf5c618cd8bc20eac34cea9358b7.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
ebc0a23966c792adccd685ca6b844ddfdd41cf5c618cd8bc20eac34cea9358b7.exe
Resource
win10v2004-20230915-en
General
-
Target
ebc0a23966c792adccd685ca6b844ddfdd41cf5c618cd8bc20eac34cea9358b7
-
Size
12.4MB
-
MD5
cf53d66004b4c6ab45fb4a80a2f0f775
-
SHA1
5bc0e3a99580f6d290ae961b5ade47ac51994980
-
SHA256
ebc0a23966c792adccd685ca6b844ddfdd41cf5c618cd8bc20eac34cea9358b7
-
SHA512
eb9603551596469e207fdbd2e03c09c8a984f3c2569cd1bc28eda710a77a65fa28cecbeeebf7ecfdbddeb36ae702f4147720e3d8e52c3f9c4270034b90594e44
-
SSDEEP
393216:/ZaOtcKNdpN8+8QFV2Vr5sjqQNRvv40TFV2F/5lL3Y:/PjFNn86IlTQNRJWjL3Y
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ebc0a23966c792adccd685ca6b844ddfdd41cf5c618cd8bc20eac34cea9358b7
Files
-
ebc0a23966c792adccd685ca6b844ddfdd41cf5c618cd8bc20eac34cea9358b7.exe windows:6 windows x64
3ed9707a56581e612ea9f2f419b9dd5f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
SizeofResource
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 70KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 10.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 12.3MB - Virtual size: 12.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 184B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 91KB - Virtual size: 90KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ