Behavioral task
behavioral1
Sample
1c7c6703684bdda95f4dd9b3f0b46e8ba2f597ac2722b4691bef970d5652051c.exe
Resource
win7-20230831-en
General
-
Target
1c7c6703684bdda95f4dd9b3f0b46e8ba2f597ac2722b4691bef970d5652051c
-
Size
1.1MB
-
MD5
a282998562c41cd2b7b56e0ae7e51c5b
-
SHA1
e569dfbb23ae102c6aba9c8467129a2290e9bb09
-
SHA256
1c7c6703684bdda95f4dd9b3f0b46e8ba2f597ac2722b4691bef970d5652051c
-
SHA512
7c4f6f50bad1a5e1c5656a6b4b7170a5ca07911cdcd9443487e1ac42853b367fd1422a2a38c675dc30cda0f861b0dd6ca7379287459d71c5bff11e6eb5662fca
-
SSDEEP
24576:6+RR43ve+Pxe2Z40cSUq95EHkREUxYZ1IpptI6gdIJF5JQ:xiG+PMq4rEgkuk6I7uCFf
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1c7c6703684bdda95f4dd9b3f0b46e8ba2f597ac2722b4691bef970d5652051c
Files
-
1c7c6703684bdda95f4dd9b3f0b46e8ba2f597ac2722b4691bef970d5652051c.exe windows:4 windows x86
cf5f413d5a24978572e36283b3a59cfb
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasHangUpA
winmm
midiStreamOut
ws2_32
recvfrom
kernel32
GetCurrentProcess
GetModuleHandleA
GetProcAddress
VirtualProtect
user32
GetClassNameA
MessageBoxA
gdi32
CreateCompatibleBitmap
winspool.drv
DocumentPropertiesA
advapi32
RegQueryValueA
shell32
SHBrowseForFolderA
ole32
StgCreateDocfileOnILockBytes
oleaut32
SafeArrayUnaccessData
comctl32
ord17
oledlg
ord8
wininet
InternetCanonicalizeUrlA
comdlg32
GetFileTitleA
Sections
.text Size: - Virtual size: 566KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 784KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 261KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 204KB - Virtual size: 217KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 143KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 960KB - Virtual size: 960KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ