Behavioral task
behavioral1
Sample
fcc8eee6d906d93800a9ab2b53d09cc87d84ff08f5da4a3231319014cc4d9d89.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
fcc8eee6d906d93800a9ab2b53d09cc87d84ff08f5da4a3231319014cc4d9d89.exe
Resource
win10v2004-20230915-en
General
-
Target
fcc8eee6d906d93800a9ab2b53d09cc87d84ff08f5da4a3231319014cc4d9d89
-
Size
4.4MB
-
MD5
36a57c9d51a36357541d1b6fab2f26a6
-
SHA1
9ec285745cebcdac9056534564bedfff26ed0733
-
SHA256
fcc8eee6d906d93800a9ab2b53d09cc87d84ff08f5da4a3231319014cc4d9d89
-
SHA512
28c0459144a26ddede9d464e21beac292b23b28cb418f2df5af03689493a4af4c639f724383c7c3184c6f6c527c082255ff677173f2821e9176aef90709053fc
-
SSDEEP
98304:A/U4y5jK8UBr6kRsNe0kysLUQV0DCw/1pWEFLb6dsbGqoA+x:AcZKtB2JeXysR0GPiL2dWwx
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fcc8eee6d906d93800a9ab2b53d09cc87d84ff08f5da4a3231319014cc4d9d89
Files
-
fcc8eee6d906d93800a9ab2b53d09cc87d84ff08f5da4a3231319014cc4d9d89.exe windows:5 windows x86
619869976855d118ca9d61c56907ae78
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord3262
msvcrt
_except_handler3
kernel32
SizeofResource
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SendMessageA
CharUpperBuffW
wtsapi32
WTSSendMessageW
advapi32
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
Sections
.text Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 4.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 4.3MB - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 308B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 88KB - Virtual size: 87KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ