Behavioral task
behavioral1
Sample
5dc1c24a4c4dbc14b997cd7013e4298c9a68ebfae2853c7cfb381b63dd9258f8.exe
Resource
win7-20230831-en
General
-
Target
5dc1c24a4c4dbc14b997cd7013e4298c9a68ebfae2853c7cfb381b63dd9258f8
-
Size
2.0MB
-
MD5
b1b4e4915069498a9ac6b33c9d07ebb4
-
SHA1
cee1e726794f20398f92748809532d614338e376
-
SHA256
5dc1c24a4c4dbc14b997cd7013e4298c9a68ebfae2853c7cfb381b63dd9258f8
-
SHA512
964ed639eebdad25732efaa357688b5a38d908a90e2f23527bda29180773d08d8dde3b436de54e15faeae959d040a5df612372b21bd0e4c3f4fee741b07467f3
-
SSDEEP
49152:mJhh1tAQSmtuKf7BbKe4xfFX7InVDwKntYGUX4hdEonpwPMW:mlbAnmtus71Ke4HyDwKnt5VnpwZ
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5dc1c24a4c4dbc14b997cd7013e4298c9a68ebfae2853c7cfb381b63dd9258f8
Files
-
5dc1c24a4c4dbc14b997cd7013e4298c9a68ebfae2853c7cfb381b63dd9258f8.exe windows:5 windows x86
42bd3d17fd981dcc7eca53ed77d40bfd
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersion
GetVersionExA
GetVersionExW
IsBadWritePtr
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
RegisterClipboardFormatA
gdi32
StretchBlt
winmm
midiStreamOut
winspool.drv
ClosePrinter
advapi32
CryptHashData
shell32
ShellExecuteA
ole32
CLSIDFromProgID
oleaut32
SafeArrayAccessData
comctl32
ImageList_Destroy
ws2_32
recvfrom
comdlg32
GetOpenFileNameA
Sections
.text Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 748KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 150KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 963KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ