__fn1
Behavioral task
behavioral1
Sample
c012bdefe68c21d11620ddd5a83304a9cc06de19e16344811923e5681cb1b92f.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
c012bdefe68c21d11620ddd5a83304a9cc06de19e16344811923e5681cb1b92f.dll
Resource
win10v2004-20230915-en
General
-
Target
c012bdefe68c21d11620ddd5a83304a9cc06de19e16344811923e5681cb1b92f
-
Size
9.9MB
-
MD5
8ccb2ef4435878ae52006069a984d611
-
SHA1
88299e9cde5e30471612171499300cede3b4f4cd
-
SHA256
c012bdefe68c21d11620ddd5a83304a9cc06de19e16344811923e5681cb1b92f
-
SHA512
2841cc4081d6510b7039f115ad83d7faec9a432f0e5fd16d4aeeaef146f9b2c756322ca83d8b36bd5b92eeaa58e946513113b6a6241d54c741540d40afbf75ed
-
SSDEEP
196608:VD1k3c+Bf8hB8EG1jLiUCJZ5xo7KrU6QIComhAuBTsmxCmZ7Sn6V:tO3cg02PfCJFEKrRCFmu3xCmZ7G6V
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c012bdefe68c21d11620ddd5a83304a9cc06de19e16344811923e5681cb1b92f
Files
-
c012bdefe68c21d11620ddd5a83304a9cc06de19e16344811923e5681cb1b92f.dll windows:5 windows x86
a173b451149c418ea0ac287ed7c81101
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
Sleep
OpenProcess
CreateThread
OutputDebugStringA
VirtualProtectEx
ExitProcess
IsDebuggerPresent
ReadProcessMemory
WriteProcessMemory
GetCurrentProcessId
GetCurrentThread
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
GetCurrentProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetPrivateProfileIntA
WritePrivateProfileStringA
GetTickCount
SetEndOfFile
SetEnvironmentVariableA
WriteConsoleW
LoadLibraryW
OutputDebugStringW
CreateFileW
LCMapStringW
CompareStringW
GetStringTypeW
SetStdHandle
FlushFileBuffers
GetConsoleCP
GetModuleFileNameW
WriteFile
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetModuleFileNameA
GetProcessHeap
ReadConsoleW
GetConsoleMode
SetFilePointerEx
SetFilePointer
GetStartupInfoW
WaitForSingleObject
CreateRemoteThread
GetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
InterlockedIncrement
HeapSize
GetSystemTimeAsFileTime
AreFileApisANSI
GetModuleHandleExW
InterlockedDecrement
HeapReAlloc
HeapAlloc
RtlUnwind
RaiseException
GetModuleHandleW
GetProcAddress
CloseHandle
SetLastError
ResumeThread
TerminateProcess
LoadLibraryExW
VirtualQuery
VirtualProtect
InterlockedCompareExchange
GetCurrentThreadId
FlushInstructionCache
SetThreadContext
GetThreadContext
VirtualFree
SuspendThread
VirtualAlloc
MultiByteToWideChar
GetModuleHandleA
GetFileType
GetStdHandle
EncodePointer
DecodePointer
IsProcessorFeaturePresent
ReadFile
HeapFree
GetCommandLineA
GetPrivateProfileStringA
GetVersionExW
GetVersion
VirtualQuery
GetSystemTimeAsFileTime
GetModuleHandleA
CreateEventA
GetModuleFileNameW
LoadLibraryA
TerminateProcess
GetCurrentProcess
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
FreeLibrary
GetTickCount
GlobalFree
GetProcAddress
LocalAlloc
LocalFree
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleW
LoadResource
MultiByteToWideChar
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetCommandLineA
RaiseException
RtlUnwind
HeapFree
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
HeapReAlloc
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteFile
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
SetStdHandle
user32
GetDesktopWindow
GetProcessWindowStation
GetUserObjectInformationW
SetDlgItemTextA
SendMessageA
GetDlgItem
GetDlgItemInt
PostMessageW
SendMessageW
MessageBoxA
ShowWindow
SendDlgItemMessageW
SetWindowTextA
IsWindowVisible
SetDlgItemTextW
SetTimer
IsDlgButtonChecked
SendDlgItemMessageA
GetDlgItemTextA
SetWindowLongA
GetWindowLongA
CreateWindowExA
CallWindowProcA
EndPaint
BeginPaint
SetForegroundWindow
SetWindowPos
CreateDialogIndirectParamW
GetForegroundWindow
IsWindow
MoveWindow
CreateDialogParamW
GetClientRect
GetDlgItemTextW
GetUserObjectInformationW
CharUpperBuffW
MessageBoxW
GetProcessWindowStation
comctl32
ord17
InitCommonControlsEx
ws2_32
gethostbyname
inet_ntoa
WSAStartup
closesocket
shutdown
select
__WSAFDIsSet
recv
send
WSAGetLastError
socket
inet_addr
htons
ioctlsocket
connect
accept
setsockopt
bind
listen
advapi32
RegisterEventSourceA
ReportEventA
DeregisterEventSource
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: 208KB - Virtual size: 208KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 120KB - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 3.6MB - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.9MB - Virtual size: 5.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.l1 Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE