test
Behavioral task
behavioral1
Sample
6d0ac1e3fcc288af5f8df291d69d31808fdf407d105faab9c8df2ab9d1c3359b.dll
Resource
win7-20230831-en
General
-
Target
6d0ac1e3fcc288af5f8df291d69d31808fdf407d105faab9c8df2ab9d1c3359b
-
Size
13.9MB
-
MD5
7470840e75c6f6542be661b38c417973
-
SHA1
6ca6bafb27b771a309295a223bd55c3dfd29e8a7
-
SHA256
6d0ac1e3fcc288af5f8df291d69d31808fdf407d105faab9c8df2ab9d1c3359b
-
SHA512
9b7edddf604630f048c5c8fd5b721f4235837a1a65e8f9cae6e572d0134d16fabdc9c432a480f1811465878c060d01605fb3c8e2387bec2659a82870bdc117a4
-
SSDEEP
393216:guG6lfE/PTc4jC/32UPJ4xXvmznJDxuk+KcwgRPf8Y6:gufxE/PFjC+DfmzCdwgP
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6d0ac1e3fcc288af5f8df291d69d31808fdf407d105faab9c8df2ab9d1c3359b
Files
-
6d0ac1e3fcc288af5f8df291d69d31808fdf407d105faab9c8df2ab9d1c3359b.dll windows:4 windows x86
0a623908f707dbb69e0ca99143159cc8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
msvfw32
DrawDibDraw
avifil32
AVIStreamInfoA
kernel32
GetVersionExA
GetVersion
CreateThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
LoadStringA
gdi32
GetDeviceCaps
winmm
PlaySoundA
winspool.drv
ClosePrinter
comdlg32
GetOpenFileNameA
advapi32
RegOpenKeyExA
shell32
Shell_NotifyIconA
ole32
OleInitialize
oleaut32
LoadTypeLi
comctl32
_TrackMouseEvent
ws2_32
closesocket
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 252KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 9.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 13.9MB - Virtual size: 13.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 12KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ