Behavioral task
behavioral1
Sample
482fb86328479e5524e793f3e65f7a523582ead6ae7611581c2df698a5aa445a.exe
Resource
win7-20230831-en
General
-
Target
482fb86328479e5524e793f3e65f7a523582ead6ae7611581c2df698a5aa445a
-
Size
11.0MB
-
MD5
88d6a0e85599a66ba3b365dc44118bdb
-
SHA1
42e90325946d5b504205827d2d9beabd7a3cc429
-
SHA256
482fb86328479e5524e793f3e65f7a523582ead6ae7611581c2df698a5aa445a
-
SHA512
4cb36b0826a206014b72735ec40ec8d2b365f3127a47a125c91fb18422dad0c020c16ffe5b13f178746454e0786ea37117f9d223a685d8f9749197444912e2d9
-
SSDEEP
196608:UHqgh4rWr6Messkiu50E3lEJqEzwj4Fl29d2sufEETlzMMMY8Lvq0mCOxm9/ApkK:wq+4rwLsnu50IaEhGlwd2DfEEeKiq0ur
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 482fb86328479e5524e793f3e65f7a523582ead6ae7611581c2df698a5aa445a
Files
-
482fb86328479e5524e793f3e65f7a523582ead6ae7611581c2df698a5aa445a.exe windows:5 windows x86
d9a077877f019834ad03e562b641ba4b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasDialA
shlwapi
PathFileExistsW
winmm
midiStreamRestart
ws2_32
recvfrom
kernel32
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
RegisterClassExW
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetViewportExtEx
msimg32
GradientFill
winspool.drv
ClosePrinter
comdlg32
GetOpenFileNameW
advapi32
RegQueryValueA
shell32
SHBrowseForFolderA
ole32
CoTaskMemAlloc
oleaut32
VarDateFromStr
odbc32
ord46
comctl32
ImageList_GetIcon
oledlg
ord8
wininet
InternetCanonicalizeUrlA
wldap32
ord29
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 615KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 11.0MB - Virtual size: 11.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ