Behavioral task
behavioral1
Sample
9746c208faee23e4dec550288689eafbb40acfeb64974b1b88991f1861f5b00d.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
9746c208faee23e4dec550288689eafbb40acfeb64974b1b88991f1861f5b00d.exe
Resource
win10v2004-20231020-en
General
-
Target
9746c208faee23e4dec550288689eafbb40acfeb64974b1b88991f1861f5b00d
-
Size
5.4MB
-
MD5
3ba3fff223411e4d24aa2e81b362d986
-
SHA1
ced793ce5bfb1243d9ff347a078cc4cdb98e2fb3
-
SHA256
9746c208faee23e4dec550288689eafbb40acfeb64974b1b88991f1861f5b00d
-
SHA512
f52ac2053a212f7fb11fb93d038517b8d7c81ddce1563fa467b0967e5be9ce4d5747ee45b30f997d90838a31e754040b7023b10d95342c1937e6650af54afd9d
-
SSDEEP
98304:TDhcZ9mzLwLMZ1kHf3wUv/NpOSqHZUOjkvhGR1WimDS8JEgC7cJ1X8xj:89OLwmgfr/N+Uo2hGy7m8egkcPM
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9746c208faee23e4dec550288689eafbb40acfeb64974b1b88991f1861f5b00d
Files
-
9746c208faee23e4dec550288689eafbb40acfeb64974b1b88991f1861f5b00d.exe windows:5 windows x86
2df728b239afe0a1df3307c216dbb0f4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
ws2_32
recv
wtsapi32
WTSSendMessageW
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Sections
.text Size: - Virtual size: 69KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.4MB - Virtual size: 5.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ