Behavioral task
behavioral1
Sample
4f8a6d1128a54caab15ad2b7c8d46ac24e192d3d3c9c220b83b6e68e35540e84.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
4f8a6d1128a54caab15ad2b7c8d46ac24e192d3d3c9c220b83b6e68e35540e84.exe
Resource
win10v2004-20230915-en
General
-
Target
4f8a6d1128a54caab15ad2b7c8d46ac24e192d3d3c9c220b83b6e68e35540e84
-
Size
12.7MB
-
MD5
eeda070b527c99ff626827a8751143c7
-
SHA1
79485becef02215a43c30ee975ff946adf4e6d79
-
SHA256
4f8a6d1128a54caab15ad2b7c8d46ac24e192d3d3c9c220b83b6e68e35540e84
-
SHA512
aaacf52c3a99a416fe8fafd44861fa32f5ae7d5d25c240e60d5bcd32a55aad4dd5fc45787423be69187e456df259fe9e6f9143725ab1c1a6e496d970e861b46c
-
SSDEEP
393216:LaaIHbOvq2aXib3uK6m+hio58eqLO1erf:LaN6vqRy+KwF58TO14f
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4f8a6d1128a54caab15ad2b7c8d46ac24e192d3d3c9c220b83b6e68e35540e84
Files
-
4f8a6d1128a54caab15ad2b7c8d46ac24e192d3d3c9c220b83b6e68e35540e84.exe windows:5 windows x86
75529c930d847e603db6f5ad48af78af
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
iphlpapi
GetAdaptersInfo
winmm
midiStreamOut
ws2_32
WSAStartup
kernel32
GetVersionExA
GetVersion
GetSystemInfo
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
WindowFromPoint
gdi32
GetObjectA
winspool.drv
ClosePrinter
advapi32
RegQueryValueA
shell32
ShellExecuteA
ole32
CLSIDFromString
oleaut32
VariantInit
comctl32
ord17
comdlg32
GetSaveFileNameA
Sections
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 18.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 353KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 9.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 12.6MB - Virtual size: 12.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 76KB - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ