Behavioral task
behavioral1
Sample
98832301dfeeecdc8a0f81b194199d45be6a52cef73835fca2c8a4d8f610db48.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
98832301dfeeecdc8a0f81b194199d45be6a52cef73835fca2c8a4d8f610db48.exe
Resource
win10v2004-20230915-en
General
-
Target
98832301dfeeecdc8a0f81b194199d45be6a52cef73835fca2c8a4d8f610db48
-
Size
4.1MB
-
MD5
af4b371519949421dd6e87a33a303f10
-
SHA1
497ce57a077948d152c908d0d3515ea0356960ef
-
SHA256
98832301dfeeecdc8a0f81b194199d45be6a52cef73835fca2c8a4d8f610db48
-
SHA512
9ba02d406f99d91fe9748005b361011de744581799c1fb6f737534e4ccc8b3f569198a948b76df8eea9490272ba556120e5e02b2c250188d9ffba24066624cc7
-
SSDEEP
24576:bgx2ww50ZmvU0igege1J+V7E0gagOTmKLxiNr9lqPsCSBTrp+LeQKrVCyC+qM+IW:Mx3w50TYegepcTmb7br9+C0ytGFV8i
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 98832301dfeeecdc8a0f81b194199d45be6a52cef73835fca2c8a4d8f610db48
Files
-
98832301dfeeecdc8a0f81b194199d45be6a52cef73835fca2c8a4d8f610db48.exe windows:6 windows x86
f37b14d7db28f33bb782e26e7c3cba35
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleExW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
advapi32
CheckTokenMembership
ole32
CoGetObject
Sections
.text Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 308KB - Virtual size: 307KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 259KB - Virtual size: 259KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 44KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 308KB - Virtual size: 307KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ