Behavioral task
behavioral1
Sample
e8fc1ab6eb39b6367f77354d317a805a1d16e5d0eba204b717f7a7802e9d9188.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
e8fc1ab6eb39b6367f77354d317a805a1d16e5d0eba204b717f7a7802e9d9188.exe
Resource
win10v2004-20230915-en
General
-
Target
e8fc1ab6eb39b6367f77354d317a805a1d16e5d0eba204b717f7a7802e9d9188
-
Size
3.8MB
-
MD5
eb7789f5eab301eff3fb110ae19071dd
-
SHA1
d30ccb6102a2ca898a4cc01729a1f811dee6a34f
-
SHA256
e8fc1ab6eb39b6367f77354d317a805a1d16e5d0eba204b717f7a7802e9d9188
-
SHA512
d3c5c8a7075ee63b50d390cf63ddfbe16f444ea06286dd035b6fe1154faea58cf6560931a903fd1902cc3d7a952ba754cfb27d8659fd56e5c7876aa4c79f066b
-
SSDEEP
98304:8ita00HbOUBMM+1QWeFNeZemM1WN9hFZwfuFrEKbTOO7ANrlo1VuK3zm41c:HYNHbOE9+1deFAemM+DZwfurEtNrSyKe
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e8fc1ab6eb39b6367f77354d317a805a1d16e5d0eba204b717f7a7802e9d9188
Files
-
e8fc1ab6eb39b6367f77354d317a805a1d16e5d0eba204b717f7a7802e9d9188.exe windows:5 windows x86
be18bfb3980911889c69fa6f47c96365
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
gdi32
GetPolyFillMode
gdiplus
GdipGetRegionBounds
user32
SetScrollPos
kernel32
GetVersion
GetVersionExA
GetVersionExA
GetVersion
FreeEnvironmentStringsA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
ole32
CLSIDFromProgID
imm32
ImmReleaseContext
shell32
ShellExecuteA
shlwapi
PathFileExistsA
winmm
waveOutPause
ws2_32
htons
msvfw32
DrawDibDraw
avifil32
AVIStreamGetFrame
rasapi32
RasGetConnectStatusA
winspool.drv
OpenPrinterA
comdlg32
GetFileTitleA
advapi32
RegCloseKey
oleaut32
SafeArrayUnaccessData
comctl32
_TrackMouseEvent
wininet
HttpQueryInfoA
Sections
.text Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 704KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 3.8MB - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 72KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ