Behavioral task
behavioral1
Sample
d9c513a6fc347074efe9f259def5b1ce5cbe4a02de89fd706ecac923ab549e14.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
d9c513a6fc347074efe9f259def5b1ce5cbe4a02de89fd706ecac923ab549e14.exe
Resource
win10v2004-20230915-en
General
-
Target
d9c513a6fc347074efe9f259def5b1ce5cbe4a02de89fd706ecac923ab549e14
-
Size
11.9MB
-
MD5
1eb6b744a50a9699b6094878e7d449fc
-
SHA1
51b9447b25d8ef95def4b48ae0bc94029dda8042
-
SHA256
d9c513a6fc347074efe9f259def5b1ce5cbe4a02de89fd706ecac923ab549e14
-
SHA512
07d1ad87e98889d8a4ba62fa2133bb5274e3fcc3f656f51a16ae417c7def81cd33e7574135db787e45fd7661185ddfb91b941647665d435ac307443185c8d585
-
SSDEEP
196608:yJz5M6C/wAQAa+UJjuMkHTjnob+o/Njy/gfP89ltAXorfU2NJnpx/Q7:yJz5MRZQAnApYHnbWywP89l6afR
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d9c513a6fc347074efe9f259def5b1ce5cbe4a02de89fd706ecac923ab549e14
Files
-
d9c513a6fc347074efe9f259def5b1ce5cbe4a02de89fd706ecac923ab549e14.exe windows:5 windows x86
725a5515554e8a320d0074caa49f7916
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasHangUpA
winmm
midiStreamRestart
ws2_32
WSACleanup
kernel32
GetVersion
GetVersionExA
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetDlgItem
gdi32
GetViewportExtEx
winspool.drv
OpenPrinterA
advapi32
RegSetValueExA
shell32
Shell_NotifyIconA
ole32
OleRun
oleaut32
SafeArrayAccessData
comctl32
ord17
wininet
InternetCanonicalizeUrlA
comdlg32
ChooseColorA
Sections
.text Size: - Virtual size: 705KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 391KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 6.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 11.9MB - Virtual size: 11.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ