Behavioral task
behavioral1
Sample
237b89b89d3a322738345d1d8b29a7e95f0093390ac95b1c853c48623c097227.exe
Resource
win7-20231023-en
General
-
Target
237b89b89d3a322738345d1d8b29a7e95f0093390ac95b1c853c48623c097227
-
Size
305KB
-
MD5
cfaaa78f8c90bb3f9b6803ffb9af9b58
-
SHA1
52e02bba0a35c86ec6e1d3b606bc2944ee103dc8
-
SHA256
237b89b89d3a322738345d1d8b29a7e95f0093390ac95b1c853c48623c097227
-
SHA512
f7a5515d1167dde97603216847c77dd4af6c17fd432d92f3f6825e27bcc14df9d960809937d9df918b52957b7ba6ff3c522475e918f9809d49aedeb9a052c2e5
-
SSDEEP
6144:zVS7GfEUQMW0NRbNudt7eG4gKF6FYtS3efEv/miYWyOiKwI97MQ:IaChUbQ5i6F13gOfYWyHRPQ
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 237b89b89d3a322738345d1d8b29a7e95f0093390ac95b1c853c48623c097227
Files
-
237b89b89d3a322738345d1d8b29a7e95f0093390ac95b1c853c48623c097227.exe windows:4 windows x86 arch:x86
3f675ea8b935df69c9875d5c2e7bda8b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42u
ord3592
msvcrt
srand
kernel32
GetVersion
GetVersionExW
GetCurrentProcess
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetWindow
gdi32
SelectObject
comdlg32
GetSaveFileNameW
advapi32
RegDeleteKeyW
shell32
ShellExecuteW
comctl32
ord17
ole32
CoUninitialize
msimg32
TransparentBlt
gdiplus
GdiplusStartup
iphlpapi
GetIfTable
Sections
.text Size: - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 107KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 204KB - Virtual size: 202KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 92KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE