Behavioral task
behavioral1
Sample
update.exe
Resource
win10-20230915-en
Behavioral task
behavioral2
Sample
update.exe
Resource
win10v2004-20230915-en
General
-
Target
update.exe
-
Size
5.9MB
-
MD5
b69cbeaace9451ce18fe64eee03ba031
-
SHA1
6832cd260426c68a7e5fa6546b4fa098ca6e5349
-
SHA256
7558b93e9ff3faa59cd856a8d7cdd04745f322a638a0e192f19564a4e13278f3
-
SHA512
b1f37ebfd8bd7bc89db9f17ab8b52bdd9b6d5bcf73c59c826cfff3dc0caf336a8c909b1d0b67b859604de1b5ccefb70b2a13c3509b0739cfb5e11685be4fe824
-
SSDEEP
98304:OVQuW2D+iKN7Ruh7MG0Cdg0ig4y1zHafNgxztBS65Pm2bymfCcs1HasD:yQuD/KnuhkCe0ZL1efNgxpAMPfbmz
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource update.exe
Files
-
update.exe.exe windows:6 windows x64
be5a7e8f9bd5f3dcd617ccc27dc146bc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
gethostname
crypt32
CertFindExtension
wldap32
ord211
normaliz
IdnToAscii
kernel32
InitializeSListHead
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
RegisterClassExA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetDeviceCaps
advapi32
CryptDestroyHash
shell32
ShellExecuteW
msvcp140
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
xinput1_3
ord4
imm32
ImmSetCompositionWindow
urlmon
URLDownloadToFileA
d3d9
Direct3DCreate9
d3dx9_43
D3DXCreateTextureFromFileA
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
api-ms-win-crt-string-l1-1-0
strncpy
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
api-ms-win-crt-stdio-l1-1-0
_lseeki64
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-math-l1-1-0
floorf
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 655KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 531KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.8MB - Virtual size: 5.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 102KB - Virtual size: 101KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ