Behavioral task
behavioral1
Sample
e636d084ac7ad313e1b8d08ecbc764b802a30d61b92577b74d8ca940b9da50ae.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
e636d084ac7ad313e1b8d08ecbc764b802a30d61b92577b74d8ca940b9da50ae.exe
Resource
win10v2004-20230915-en
General
-
Target
e636d084ac7ad313e1b8d08ecbc764b802a30d61b92577b74d8ca940b9da50ae
-
Size
1.4MB
-
MD5
1e620ff844712d3b48c580ca5dcf4423
-
SHA1
20fa6c4831d8cc66a9559ebe8e3ce5c5af78c13e
-
SHA256
e636d084ac7ad313e1b8d08ecbc764b802a30d61b92577b74d8ca940b9da50ae
-
SHA512
51f21a63fc3eb6d7bb01b5c85a6660b92bac0d800d9cd5b3321f1fedf034e43a308e996794c9277d1867bf1ed3e4fcc396a3aa50596eca287433fcf32ae22376
-
SSDEEP
24576:OCvmqFeq57iQYm0GkeIIWm6Qut+lg9/5pjBPRrSpae8a5aM9RbRx39QJLC:OCwq59uk9utwC5pjKr86H31FWC
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e636d084ac7ad313e1b8d08ecbc764b802a30d61b92577b74d8ca940b9da50ae
Files
-
e636d084ac7ad313e1b8d08ecbc764b802a30d61b92577b74d8ca940b9da50ae.exe windows:5 windows x86
a2abc93f848e8428166184e18709f492
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiOutPrepareHeader
ws2_32
listen
kernel32
HeapFree
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
LoadCursorA
gdi32
GetWindowOrgEx
winspool.drv
OpenPrinterA
advapi32
RegSetValueExA
shell32
SHGetSpecialFolderPathA
ole32
CLSIDFromProgID
oleaut32
RegisterTypeLi
comctl32
ord17
comdlg32
GetFileTitleA
Sections
.text Size: - Virtual size: 649KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 149KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 228KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 762KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 204KB - Virtual size: 202KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ