Behavioral task
behavioral1
Sample
ea2bdd1dfe3952562aae5c797848315841b7673668e9acca26f40791c5eafaef.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
ea2bdd1dfe3952562aae5c797848315841b7673668e9acca26f40791c5eafaef.exe
Resource
win10v2004-20230915-en
General
-
Target
ea2bdd1dfe3952562aae5c797848315841b7673668e9acca26f40791c5eafaef
-
Size
2.1MB
-
MD5
5c511eb18f9388e38e426ac4e0a52484
-
SHA1
52cd3a5191217761ab9bfaa2531b25ba66959f4a
-
SHA256
ea2bdd1dfe3952562aae5c797848315841b7673668e9acca26f40791c5eafaef
-
SHA512
65014daf6c114a92e49428bdd3a12f2490eeb03d6b1428a6f6c8bf104c0b4d149ab75b57e52fd48e5ecfd723bd4913dfd92e4772c13e9cc4977b07ee9b8a7e42
-
SSDEEP
49152:fPXpCgI9MMZInbPusmgmVbI1XHvXNeUl8f//QMPQYQDtchhsjO:fPMgqMM+nLuuEGXNcf/4MI5Yhsj
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ea2bdd1dfe3952562aae5c797848315841b7673668e9acca26f40791c5eafaef
Files
-
ea2bdd1dfe3952562aae5c797848315841b7673668e9acca26f40791c5eafaef.exe windows:5 windows x86
0cd2669fcdf5820477fdf2c701797263
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutPause
ws2_32
gethostbyname
msvfw32
DrawDibDraw
avifil32
AVIStreamInfoA
kernel32
GetVersionExA
GetVersion
HeapReAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
ChildWindowFromPointEx
gdi32
CreateRoundRectRgn
winspool.drv
ClosePrinter
comdlg32
GetSaveFileNameA
advapi32
RegQueryValueA
shell32
Shell_NotifyIconA
ole32
CLSIDFromString
oleaut32
SafeArrayGetUBound
comctl32
ord17
Sections
.text Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 348KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 357KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ