Behavioral task
behavioral1
Sample
6a80575c7043575a1e02fbfb42b285a3983f36ae99be43cf6ef3b8f23f1771dd.exe
Resource
win7-20231020-en
General
-
Target
6a80575c7043575a1e02fbfb42b285a3983f36ae99be43cf6ef3b8f23f1771dd
-
Size
14.0MB
-
MD5
360c6a85f2a2b182e0414e79b914efd2
-
SHA1
30537013d444ade932ad8f8777c0013188b5acab
-
SHA256
6a80575c7043575a1e02fbfb42b285a3983f36ae99be43cf6ef3b8f23f1771dd
-
SHA512
c8cbfbdbec085c4afc3c09953d7b1857e2fe3b859005745109dc007c50d2d0437fe76019008b9398eda293349e211078554a3abd8cb47146f933284c94077dda
-
SSDEEP
393216:BB//8AyYZzbif++Hj3fuD8Anqz3HBAKe8+vaC0b9MLw4M6Lhl8a9:BBjHZqf+yuQsIXBAC+vaC0CLw4z/8
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6a80575c7043575a1e02fbfb42b285a3983f36ae99be43cf6ef3b8f23f1771dd
Files
-
6a80575c7043575a1e02fbfb42b285a3983f36ae99be43cf6ef3b8f23f1771dd.exe windows:5 windows x86
f14b1367cf33ac0235610b3ae8e0cf0f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
crypt32
CryptStringToBinaryA
user32
CreateAcceleratorTableA
rasapi32
RasGetEntryDialParamsA
iphlpapi
GetAdaptersInfo
winmm
waveOutPrepareHeader
ws2_32
select
msvfw32
DrawDibDraw
avifil32
AVIStreamGetFrame
rpcrt4
UuidToStringA
gdi32
MoveToEx
msimg32
GradientFill
winspool.drv
OpenPrinterA
comdlg32
GetFileTitleA
advapi32
RegOpenKeyExA
shell32
DragAcceptFiles
ole32
CoFreeUnusedLibraries
oleaut32
VariantClear
odbc32
ord46
comctl32
ImageList_Destroy
oledlg
ord8
wininet
HttpOpenRequestA
wldap32
ord29
Sections
.text Size: - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 12.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 752KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 13.9MB - Virtual size: 13.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 72KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ