Behavioral task
behavioral1
Sample
bb96d8985acab6735cdb84a8d739e80b48e552cdfa7258bdce1f3ef9e8f1b275.exe
Resource
win7-20230831-en
General
-
Target
bb96d8985acab6735cdb84a8d739e80b48e552cdfa7258bdce1f3ef9e8f1b275
-
Size
10.9MB
-
MD5
c0de428c84fd52971adfe3285bf79864
-
SHA1
8ad282b04789ee8b15e101f9498d5bb200f80b41
-
SHA256
bb96d8985acab6735cdb84a8d739e80b48e552cdfa7258bdce1f3ef9e8f1b275
-
SHA512
fbedf6af9c5ee6e65ea9bdb43726d88a5236354e55a5cb39e7121056499d7717abaa63f5823b341e5da2bdd2404626c8d09d0656d7afdb6a2d9735c8188c60db
-
SSDEEP
196608:6fKJ0S6JUamyNf6t9GfZSPEb3tWuwj5/JP13e01DVyGDrOg71MQ6APoM2zCaemP8:6fKJ0rh/l2GfZsEbguQ9Jpx1DVyG/OVc
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bb96d8985acab6735cdb84a8d739e80b48e552cdfa7258bdce1f3ef9e8f1b275
Files
-
bb96d8985acab6735cdb84a8d739e80b48e552cdfa7258bdce1f3ef9e8f1b275.exe windows:5 windows x86
107a02841f0d6630fd3eec177b345e4e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutPrepareHeader
ws2_32
recv
rasapi32
RasGetConnectStatusA
kernel32
GetVersionExA
GetVersion
InterlockedDecrement
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
InflateRect
gdi32
Ellipse
winspool.drv
ClosePrinter
advapi32
RegSetValueExA
shell32
Shell_NotifyIconA
ole32
StgCreateDocfileOnILockBytes
oleaut32
VariantClear
comctl32
ImageList_GetImageCount
oledlg
ord8
wininet
InternetCrackUrlA
comdlg32
GetSaveFileNameA
Sections
.text Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 588KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 6.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 10.9MB - Virtual size: 10.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ