Behavioral task
behavioral1
Sample
32db0d144cf45537ffd54d9e2a0041fdb25b71d25ade97a512b5f943fa75a8bd.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
32db0d144cf45537ffd54d9e2a0041fdb25b71d25ade97a512b5f943fa75a8bd.exe
Resource
win10v2004-20230915-en
General
-
Target
32db0d144cf45537ffd54d9e2a0041fdb25b71d25ade97a512b5f943fa75a8bd
-
Size
3.1MB
-
MD5
9b2bd543feb5e7504453e6afe10a8213
-
SHA1
f6e4bb642fb5a4788ef950fdd348033c540448a1
-
SHA256
32db0d144cf45537ffd54d9e2a0041fdb25b71d25ade97a512b5f943fa75a8bd
-
SHA512
6389254b8098763556b78af3ff2a8cb36cf803d0600db254e85c3884f11cacf6c13a2fd0c3ee19fb5fd023a523f9d474b2f55ca3a797cf6a8f204e94e4b9cbce
-
SSDEEP
98304:W7GeAAVhpjsC9xqSxkUn1W+od6pIwBkaVWenXk:W7f1fpOmkUn1WZxaVhU
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 32db0d144cf45537ffd54d9e2a0041fdb25b71d25ade97a512b5f943fa75a8bd
Files
-
32db0d144cf45537ffd54d9e2a0041fdb25b71d25ade97a512b5f943fa75a8bd.exe windows:5 windows x86
218d333d1df6e45c7f41d9e929690716
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ddraw
DirectDrawCreate
dsound
ord1
winmm
mmioClose
dinput
DirectInputCreateA
wsock32
gethostname
lua51
luaL_buffinit
dbghelp
MiniDumpWriteDump
kernel32
TlsGetValue
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetSystemMetrics
CharUpperBuffW
gdi32
CreateDCA
advapi32
RegCloseKey
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
shell32
ShellExecuteA
ole32
CoInitialize
netapi32
Netbios
iphlpapi
GetAdaptersInfo
imm32
ImmDestroyContext
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 90KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 517.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 276B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ