Behavioral task
behavioral1
Sample
bc389ae8b24037f6718753ca0c5535867867fc201ed10c3dd05b2c6d86a2ae49.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
bc389ae8b24037f6718753ca0c5535867867fc201ed10c3dd05b2c6d86a2ae49.exe
Resource
win10v2004-20230915-en
General
-
Target
bc389ae8b24037f6718753ca0c5535867867fc201ed10c3dd05b2c6d86a2ae49
-
Size
10.1MB
-
MD5
1cafe7e415b870cc2c4ab9af6b53e0d6
-
SHA1
fca4c522405b633908bfa541d49bce5ec00a9ab0
-
SHA256
bc389ae8b24037f6718753ca0c5535867867fc201ed10c3dd05b2c6d86a2ae49
-
SHA512
2496fd842662b17140114ac6f148f5829d0a5f9119e2bc2b497ba30a5a410e2ec00f37ea852c7d994d38120ceffef63c67c3273c81ef420630e47c57eaf7efeb
-
SSDEEP
196608:pkzIvqWMCX4/e3zKC1EohC7CCk7oNvFKHDYXMwqjzfPs6OLU:CI5Xz3zM2JovKyMwUvOw
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bc389ae8b24037f6718753ca0c5535867867fc201ed10c3dd05b2c6d86a2ae49
Files
-
bc389ae8b24037f6718753ca0c5535867867fc201ed10c3dd05b2c6d86a2ae49.exe windows:5 windows x86
309f0085dcba345161843ccc932ce0ca
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamProperty
ws2_32
ntohl
kernel32
GetVersionExA
GetVersion
lstrcpynA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetDesktopWindow
gdi32
RealizePalette
winspool.drv
OpenPrinterA
advapi32
RegCloseKey
shell32
SHGetSpecialFolderPathA
ole32
OleUninitialize
oleaut32
RegisterTypeLi
comctl32
ord17
comdlg32
GetFileTitleA
Sections
.text Size: - Virtual size: 845KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 685KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 377KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 8.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 9.7MB - Virtual size: 9.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 364KB - Virtual size: 361KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ