?GetExeFolder@base@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@XZ
Behavioral task
behavioral1
Sample
cbc5de98d5e3471517f3b99dc196f0cd60f7f952bee4f43f5a39d70491816c3a.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
cbc5de98d5e3471517f3b99dc196f0cd60f7f952bee4f43f5a39d70491816c3a.dll
Resource
win10v2004-20230915-en
General
-
Target
cbc5de98d5e3471517f3b99dc196f0cd60f7f952bee4f43f5a39d70491816c3a
-
Size
2.7MB
-
MD5
fb6324a954f35c5cd7ba0f4723f8b7a8
-
SHA1
3c378fc4e7fc37a0c3510f94971703e9a653aa72
-
SHA256
cbc5de98d5e3471517f3b99dc196f0cd60f7f952bee4f43f5a39d70491816c3a
-
SHA512
cb73d0a0d1e89882ed1c1a274052df22296719b3750ea99b881fe60d6f71ed729f4ea864b4d958353060523335e30ef23e9028690bcad8e0dd8782c9f5069635
-
SSDEEP
49152:t+XW3Xb5ftiT/XhhcQIdwgJx5PpJG9hiMMshsWuEdQzy9cNc811hHSMF3C3tfnRQ:YXkbopa9pJPGDJMs2GUTNh7fF3CdPRQ
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cbc5de98d5e3471517f3b99dc196f0cd60f7f952bee4f43f5a39d70491816c3a
Files
-
cbc5de98d5e3471517f3b99dc196f0cd60f7f952bee4f43f5a39d70491816c3a.dll windows:6 windows x86
a18d4c9e3f3975c33742500ba6ad90d9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
ApplicationRecoveryFinished
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
ReleaseCapture
gdi32
GetViewportOrgEx
msimg32
TransparentBlt
winspool.drv
OpenPrinterA
advapi32
RegDeleteKeyA
shell32
SHGetDesktopFolder
shlwapi
PathFindExtensionA
uxtheme
DrawThemeTextEx
dwmapi
DwmIsCompositionEnabled
ole32
CoInitialize
oleaut32
VariantClear
oleacc
AccessibleObjectFromWindow
gdiplus
GdipCloneImage
imm32
ImmGetOpenStatus
winmm
PlaySoundA
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 278KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 374KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.Cream Size: - Virtual size: 512B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp2 Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 160B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ