Behavioral task
behavioral1
Sample
a8a70dfcc5b3afecf6d9183ed44c7c52a23702a166f02bb778eb1023fa6fa235.exe
Resource
win7-20230831-en
General
-
Target
a8a70dfcc5b3afecf6d9183ed44c7c52a23702a166f02bb778eb1023fa6fa235
-
Size
8.5MB
-
MD5
580980b10511d2c670aaab85bf5e872d
-
SHA1
4a66fd6188babc6f95bc041d2ee3ce4af5b5b3e1
-
SHA256
a8a70dfcc5b3afecf6d9183ed44c7c52a23702a166f02bb778eb1023fa6fa235
-
SHA512
71d555f4b5586436013338b070b1d76776f947b5de7d2ef4173a6b096354aaf92a1f7acb635a4f4f463f148416b4ea147f62215758c9eb64bed1101b2ef1dea1
-
SSDEEP
196608:xVPGChWkrYHvkiry7YhIjqC6LflBwKh5ZitKFl9XxeB2L6o5m3eqTfF3U04zv1Tb:nOInr6vkiZhIjqC6Lfl6o9EB85muqjFS
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a8a70dfcc5b3afecf6d9183ed44c7c52a23702a166f02bb778eb1023fa6fa235
Files
-
a8a70dfcc5b3afecf6d9183ed44c7c52a23702a166f02bb778eb1023fa6fa235.exe windows:5 windows x86
88a0ce91e3c8cf1d261ccb3eb9e86650
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvfw32
DrawDibDraw
avifil32
AVIStreamGetFrame
winmm
midiStreamStop
ws2_32
WSACleanup
rasapi32
RasHangUpA
kernel32
GetVersionExA
GetVersion
GetStdHandle
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetDesktopWindow
gdi32
GetPixel
msimg32
GradientFill
winspool.drv
DocumentPropertiesA
comdlg32
GetOpenFileNameA
advapi32
RegQueryValueA
shell32
SHBrowseForFolderA
ole32
OleRun
oleaut32
SafeArrayUnaccessData
comctl32
ImageList_BeginDrag
wininet
InternetOpenA
Sections
.text Size: - Virtual size: 990KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 631KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 8.5MB - Virtual size: 8.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ