Behavioral task
behavioral1
Sample
b3a01536b7380b898fa2fae1dc46bfc2be42becf9925bb6b395ad763b7375844.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
b3a01536b7380b898fa2fae1dc46bfc2be42becf9925bb6b395ad763b7375844.dll
Resource
win10v2004-20230915-en
General
-
Target
b3a01536b7380b898fa2fae1dc46bfc2be42becf9925bb6b395ad763b7375844
-
Size
2.0MB
-
MD5
ba02f1e425766437f394d6c87d7e9e87
-
SHA1
354d7e295cd28faa213d21b26815899a18a2a96b
-
SHA256
b3a01536b7380b898fa2fae1dc46bfc2be42becf9925bb6b395ad763b7375844
-
SHA512
1a33c2316e7cd477ffd04ac42248901009c89cd245dd6f7c81efb86a6dc5c58b64dd300b950d81a6de3ce172d4c10bb15751c0bd717bdf8136bc596d800848dd
-
SSDEEP
49152:HjjDNd+mzGt9pmsu7JXAXT5wqZSEQCPpRZdZHzBmzK+TC/EzaQ:HjjDNomzGzu7aj5jZSDcRTVzsxTC/T
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b3a01536b7380b898fa2fae1dc46bfc2be42becf9925bb6b395ad763b7375844
Files
-
b3a01536b7380b898fa2fae1dc46bfc2be42becf9925bb6b395ad763b7375844.dll windows:6 windows x86
b6c39446713c76967b9e42e1948e7424
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ws2_32
closesocket
connect
htons
inet_addr
recv
send
setsockopt
gethostbyname
WSAStartup
socket
inet_ntoa
kernel32
GetProcAddress
GetProcessHeap
FreeLibrary
IsBadReadPtr
TerminateProcess
InitializeCriticalSectionEx
HeapSize
GetLastError
HeapReAlloc
CloseHandle
RaiseException
DecodePointer
DeleteCriticalSection
HeapAlloc
GetModuleFileNameW
FindClose
GetFileAttributesW
DeleteFileW
MultiByteToWideChar
WideCharToMultiByte
CreateDirectoryW
CreateFileW
SetEndOfFile
SetFilePointer
WriteFile
IsValidCodePage
FindNextFileA
FindFirstFileExA
SetFilePointerEx
GetNativeSystemInfo
LoadLibraryA
VirtualAlloc
VirtualFree
SetLastError
GetConsoleCP
FlushFileBuffers
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapFree
VirtualProtect
GetOEMCP
GetCommandLineA
WriteConsoleW
ReadConsoleW
GetConsoleMode
ReadFile
GetACP
GetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
GetModuleFileNameA
ExitProcess
GetFileType
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
GetCommandLineW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InterlockedFlushSList
RtlUnwind
OutputDebugStringW
InitializeSListHead
GetCurrentProcessId
GetStartupInfoW
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
EncodePointer
LCMapStringEx
GetSystemTimeAsFileTime
GetModuleHandleW
GetStringTypeW
GetCPInfo
InitializeCriticalSectionAndSpinCount
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetCurrentProcess
FreeLibrary
TerminateProcess
GetSystemInfo
CreateToolhelp32Snapshot
Thread32First
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
GetTickCount
GetLocalTime
GlobalFree
GetProcAddress
LocalAlloc
LoadLibraryA
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleW
LoadResource
MultiByteToWideChar
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
FlushFileBuffers
GetCurrentProcessId
GetLastError
GetModuleFileNameW
CreateEventA
GetModuleHandleA
GetSystemTimeAsFileTime
VirtualQuery
LocalFree
CreateFileA
ReadFile
GetCommandLineA
RaiseException
RtlUnwind
HeapFree
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
HeapReAlloc
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteFile
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
user32
MessageBoxW
CharUpperBuffW
MessageBoxW
wininet
InternetCloseHandle
InternetOpenW
InternetConnectW
InternetReadFile
HttpOpenRequestA
HttpOpenRequestW
HttpAddRequestHeadersA
HttpSendRequestA
HttpSendRequestW
HttpQueryInfoA
InternetConnectA
HttpQueryInfoW
winhttp
WinHttpCloseHandle
WinHttpOpen
WinHttpConnect
WinHttpReceiveResponse
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpSetTimeouts
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpQueryHeaders
WinHttpSetOption
wtsapi32
WTSSendMessageW
advapi32
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
CloseServiceHandle
QueryServiceConfigW
OpenServiceW
EnumServicesStatusExW
OpenSCManagerW
Sections
.text Size: 184KB - Virtual size: 184KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 64KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 1000KB - Virtual size: 1000KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 796KB - Virtual size: 796KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.l1 Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE