Behavioral task
behavioral1
Sample
d978ad92295bff8841e25e95f4481a912e35f830f8370465b2c5c2274fcf0f6a.exe
Resource
win7-20230831-en
General
-
Target
d978ad92295bff8841e25e95f4481a912e35f830f8370465b2c5c2274fcf0f6a
-
Size
11.3MB
-
MD5
0c1b5ec03ba7c35bf9aaafbb0b446fc9
-
SHA1
610fc978121ac7bfbdf9bebfe6a80dbf5ec0bdab
-
SHA256
d978ad92295bff8841e25e95f4481a912e35f830f8370465b2c5c2274fcf0f6a
-
SHA512
0ec51f5403c4d1b655ab108bc43a5c9f035f7c136b07078b37eac523cf1c4dcce3225401e032b7e8381f46705d65c890b763c7b9d78f78a0cd423b8db0a9df55
-
SSDEEP
196608:f7g0wDVtUMk0+I3tFgAGRHZgsScI4j/8me0iegKF4lGV1BsyXAoNTn:f5KtUZcH61ZjzV1slGzBt
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d978ad92295bff8841e25e95f4481a912e35f830f8370465b2c5c2274fcf0f6a
Files
-
d978ad92295bff8841e25e95f4481a912e35f830f8370465b2c5c2274fcf0f6a.exe windows:5 windows x86
1bdb29c68b7fa677ce4e9f890c757915
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamOut
ws2_32
WSAAsyncSelect
kernel32
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetMenu
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
ExtSelectClipRgn
winspool.drv
DocumentPropertiesA
advapi32
RegOpenKeyExA
shell32
ShellExecuteA
ole32
CoGetClassObject
oleaut32
VariantTimeToSystemTime
comctl32
ImageList_Add
oledlg
ord8
wininet
DeleteUrlCacheEntry
comdlg32
ChooseColorA
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 708KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 7.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 338KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 11.3MB - Virtual size: 11.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ