Behavioral task
behavioral1
Sample
d8dbf429c3772770eff9e666bb1ccc4f40a5a6ad88cd63dc91e87bf5bb2fc9d0.exe
Resource
win7-20230831-en
General
-
Target
d8dbf429c3772770eff9e666bb1ccc4f40a5a6ad88cd63dc91e87bf5bb2fc9d0
-
Size
10.3MB
-
MD5
c6585da78a954a2f07c155e596bb7734
-
SHA1
5f555069c266c1aa1b9afe0dd7c3ba15a990d3b8
-
SHA256
d8dbf429c3772770eff9e666bb1ccc4f40a5a6ad88cd63dc91e87bf5bb2fc9d0
-
SHA512
109ac8e4d4946a83651a337850f6613a64349849dbb42e27848a993193f507a619aa1993ac3943375c3cfa34a8762dc91ac9d002cb71e886f9a0545422a12cfa
-
SSDEEP
196608:PM0ftrYZMRuNXsx5Kj2jukbvrBRJLeKa3DbYaXi1d+C21icrbi2ZNC:oIDs0uWrszUld/2ocru
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d8dbf429c3772770eff9e666bb1ccc4f40a5a6ad88cd63dc91e87bf5bb2fc9d0
Files
-
d8dbf429c3772770eff9e666bb1ccc4f40a5a6ad88cd63dc91e87bf5bb2fc9d0.exe windows:5 windows x86
9cdcddd6eec57cbb1f95796362c77144
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
TlsGetValue
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
crypt32
CryptStringToBinaryA
user32
EnumChildWindows
iphlpapi
GetAdaptersInfo
winmm
midiStreamProperty
ws2_32
connect
version
VerQueryValueA
rasapi32
RasGetEntryDialParamsA
gdi32
RestoreDC
msimg32
GradientFill
winspool.drv
OpenPrinterA
advapi32
RegCloseKey
shell32
ShellExecuteA
ole32
CoCreateInstance
oleaut32
GetActiveObject
odbc32
ord16
comctl32
ord17
wininet
InternetCloseHandle
comdlg32
GetOpenFileNameA
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 634KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 10.2MB - Virtual size: 10.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ