Behavioral task
behavioral1
Sample
46d794b68cd45b51093ef92ace2c52741ca37512fdd5186408bd53aa0b49c9b3.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
46d794b68cd45b51093ef92ace2c52741ca37512fdd5186408bd53aa0b49c9b3.exe
Resource
win10v2004-20230915-en
General
-
Target
46d794b68cd45b51093ef92ace2c52741ca37512fdd5186408bd53aa0b49c9b3
-
Size
9.7MB
-
MD5
a13210dd73c572497f8c07fb5ab81d02
-
SHA1
d68db786acd0c02ecb3521be4d062940ad65d819
-
SHA256
46d794b68cd45b51093ef92ace2c52741ca37512fdd5186408bd53aa0b49c9b3
-
SHA512
80d16ebef8c2a8edc3f4bb0309fdb1aa49d03573f396a62e11b276de1c9d43f6c2dbf023d93d64d349b6438674f6ac8b306127157fe91ae92678a42ff50b2b5e
-
SSDEEP
196608:Smg9juMAW+mpWE2Xzhn2aKgQvQL3QU5tzghmt7ly:SmlvW+WWBBCIbf5WhsB
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 46d794b68cd45b51093ef92ace2c52741ca37512fdd5186408bd53aa0b49c9b3
Files
-
46d794b68cd45b51093ef92ace2c52741ca37512fdd5186408bd53aa0b49c9b3.exe windows:5 windows x86
307b590dd08475fae7352f596188bd68
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
iphlpapi
GetAdaptersInfo
winmm
midiStreamOpen
ws2_32
gethostname
rasapi32
RasGetConnectStatusA
msvfw32
DrawDibDraw
avifil32
AVIStreamInfoA
kernel32
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetMenuCheckMarkDimensions
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetROP2
msimg32
GradientFill
winspool.drv
DocumentPropertiesA
comdlg32
GetFileTitleA
advapi32
RegCreateKeyExA
shell32
SHGetSpecialFolderPathA
ole32
CLSIDFromProgID
oleaut32
VariantCopyInd
comctl32
ImageList_Duplicate
wininet
InternetCanonicalizeUrlA
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 595KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 6.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 9.7MB - Virtual size: 9.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ