Behavioral task
behavioral1
Sample
627f458c0bf6ea483ce5a23c862e5040b05cccdedde307f5186bce38a94d4c27.exe
Resource
win7-20230831-en
General
-
Target
627f458c0bf6ea483ce5a23c862e5040b05cccdedde307f5186bce38a94d4c27
-
Size
256KB
-
MD5
cb2567b23bbb21cf0fa6ec18286cfce4
-
SHA1
a627203ae198985b28cb5a09018670e156d1f2ed
-
SHA256
627f458c0bf6ea483ce5a23c862e5040b05cccdedde307f5186bce38a94d4c27
-
SHA512
b3560977928ae668504e914df91cb9e5fcb4e00baff1a20ab0550f5a8143b48bafdf39442b8a9a81d84b9ec6ee902ec0fb1384acbef85d19b6ca202108cfacf1
-
SSDEEP
3072:vHQcBVPTQKoDysIFef9vYb2CjfLzKCHzoVm9Xu+Pmdsj1njRuVtb3yNFJMlJuUBp:vHbjPToIFe1wtLSxVmA+PUy3EJTp
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 627f458c0bf6ea483ce5a23c862e5040b05cccdedde307f5186bce38a94d4c27
Files
-
627f458c0bf6ea483ce5a23c862e5040b05cccdedde307f5186bce38a94d4c27.exe windows:4 windows x86
64eac9fff19ac89567030c2227b58428
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapAlloc
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
PeekMessageA
MessageBoxA
shell32
CommandLineToArgvW
iphlpapi
GetIpForwardTable
advapi32
AdjustTokenPrivileges
ws2_32
WSAStartup
Sections
.text Size: - Virtual size: 142KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 122KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 64KB - Virtual size: 124KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 184KB - Virtual size: 180KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ