Behavioral task
behavioral1
Sample
bacbf156cc0ea99d84b3b41a942b1f7225a879d5f193fd7373089e774a6d2359.exe
Resource
win7-20230831-en
General
-
Target
bacbf156cc0ea99d84b3b41a942b1f7225a879d5f193fd7373089e774a6d2359
-
Size
10.1MB
-
MD5
dab833e6494f3430474e8fa52d65a772
-
SHA1
cf52c9e0c0e6b44f2bff1373d962100c9029c647
-
SHA256
bacbf156cc0ea99d84b3b41a942b1f7225a879d5f193fd7373089e774a6d2359
-
SHA512
e16163981ad17672bea9a1c02d4c909178cbce1d9658a5e3f08aa37af74989df42cf4c75020c4c442faec16be92986a4f93ac35d2483a79e232d8e75a29990d8
-
SSDEEP
196608:NHQrlWoNyNtXfa232UiYanZjuVmRxuP+lZtvQNLwqHp6/qCNTt:ZQpWoNybva/jDnBymRxlDtvQeLCg
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bacbf156cc0ea99d84b3b41a942b1f7225a879d5f193fd7373089e774a6d2359
Files
-
bacbf156cc0ea99d84b3b41a942b1f7225a879d5f193fd7373089e774a6d2359.exe windows:5 windows x86
2a1163117f02125323a89e99406f2945
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetVersion
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetDlgItem
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
shlwapi
StrToIntW
ws2_32
inet_ntoa
gdi32
CreateBitmap
comdlg32
GetOpenFileNameW
advapi32
RegCloseKey
shell32
SHGetSpecialFolderPathA
winspool.drv
ClosePrinter
comctl32
ord17
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 511KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 6.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 10.1MB - Virtual size: 10.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE