Behavioral task
behavioral1
Sample
71f9db3d01bfb45aadc041fd7e4bbee9fddfd74f1f6e210f0379c338c876e87f.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
71f9db3d01bfb45aadc041fd7e4bbee9fddfd74f1f6e210f0379c338c876e87f.exe
Resource
win10v2004-20231020-en
General
-
Target
71f9db3d01bfb45aadc041fd7e4bbee9fddfd74f1f6e210f0379c338c876e87f
-
Size
5.9MB
-
MD5
9dbc1a639d8b4a87ac423caf50d810a5
-
SHA1
d06f2a1d06005624cfb8160a4deaf3182512c9f4
-
SHA256
71f9db3d01bfb45aadc041fd7e4bbee9fddfd74f1f6e210f0379c338c876e87f
-
SHA512
535f3dd8302bb984b7e1b0f5c4a498e38f702aeaed6a387a167632faf1c95344d2c15dac7387a96c44c8d2b1955b005c06d0c58b9f862521d324b38aeab950fe
-
SSDEEP
98304:d42Jb2KbdFrotQEN3cczuUuT0n7qpbe1cO83KtFHHfRwiyl6E4g9uEt01dHm/D:d42JbtF0tQETzjuT0nu0XDFH/mll6E4M
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 71f9db3d01bfb45aadc041fd7e4bbee9fddfd74f1f6e210f0379c338c876e87f
Files
-
71f9db3d01bfb45aadc041fd7e4bbee9fddfd74f1f6e210f0379c338c876e87f.exe windows:5 windows x86
28190ef999ec94a25164470498333410
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersion
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetRect
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetTextExtentPointA
comdlg32
GetFileTitleA
winspool.drv
ClosePrinter
advapi32
RegCreateKeyExA
comctl32
ord17
oledlg
ord8
ole32
CoFreeUnusedLibraries
olepro32
ord253
oleaut32
SysStringLen
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.9MB - Virtual size: 5.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ