Behavioral task
behavioral1
Sample
2552bd059f16ac8f4643a04dd1a0f8d7a769b28921950d24bd9b88d86aa3b48c.exe
Resource
win7-20230831-en
General
-
Target
2552bd059f16ac8f4643a04dd1a0f8d7a769b28921950d24bd9b88d86aa3b48c
-
Size
2.1MB
-
MD5
c99548203d11c0595d5c27fef8b298a4
-
SHA1
1e74b672706f509783be89cbf63a9c0203f1e8f4
-
SHA256
2552bd059f16ac8f4643a04dd1a0f8d7a769b28921950d24bd9b88d86aa3b48c
-
SHA512
13ddc4e32134d275b212360e1ac9352d4a15ba6a26f50943948c9d1c2ed83859b3cfec0904d3dbe68104559768df8d372cf9df49a12238c828dd6a9080d03bd4
-
SSDEEP
49152:AUc+SdkEZtUMAbrbMEJD2JSdEqUs1TZYu0u3sZzPnRWVjT:AJ+7EZssODSSP8lZbnRs
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2552bd059f16ac8f4643a04dd1a0f8d7a769b28921950d24bd9b88d86aa3b48c
Files
-
2552bd059f16ac8f4643a04dd1a0f8d7a769b28921950d24bd9b88d86aa3b48c.exe windows:5 windows x86
bd42f0d4a52debd9a40faf556020c322
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamOpen
ws2_32
WSAGetLastError
rasapi32
RasGetConnectStatusA
kernel32
GetVersionExA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetDesktopWindow
gdi32
GetStockObject
winspool.drv
DocumentPropertiesA
advapi32
RegCreateKeyExA
shell32
ShellExecuteA
ole32
StgCreateDocfileOnILockBytes
oleaut32
RegisterTypeLi
comctl32
ord17
oledlg
ord8
wininet
InternetSetOptionA
comdlg32
GetOpenFileNameA
Sections
.text Size: - Virtual size: 784KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 364KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 850KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 152KB - Virtual size: 148KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ