Behavioral task
behavioral1
Sample
04d6d3ec056f03179782070ab38d407197ff2e2fc5c943da11de18d0085b7f3b.exe
Resource
win10v2004-20231127-en
General
-
Target
04d6d3ec056f03179782070ab38d407197ff2e2fc5c943da11de18d0085b7f3b
-
Size
6.0MB
-
MD5
7603117e8e1611e887b8c6fccbdb9d4e
-
SHA1
64634c62c3eb74bbc5cdec26082dd612a304e45d
-
SHA256
04d6d3ec056f03179782070ab38d407197ff2e2fc5c943da11de18d0085b7f3b
-
SHA512
b42d6479e51e35729bb8f98c5d990ddf6804393781f854cbfcf4188d2904c9fb69ff736917cd7c6e36af622a0e93eef854a47cc3fc47bc5f154d530f2d155f55
-
SSDEEP
98304:wCUQbcTwemgpj6KqG6F6MNl4or9cOFOoKc3lZsuavzeh/QYU+LR87CiFj4:HtbCLpjfqx/j9dF3livQ/Y4R87dq
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
04d6d3ec056f03179782070ab38d407197ff2e2fc5c943da11de18d0085b7f3b.exe windows:6 windows x86 arch:x86
379f1f8b44b71caf79408adefbc888c6
Code Sign
75:12:ce:17:65:21:7a:84:4e:1b:7a:90:84:fb:c3:e3Certificate
IssuerCN=(C) 1998-2020 Logitech. All rights reserved.Not Before07-12-2023 10:12Not After08-12-2033 10:12SubjectCN=(C) 1998-2020 Logitech. All rights reserved.39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before03-05-2023 00:00Not After02-08-2034 23:59SubjectCN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02-05-2019 00:00Not After18-01-2038 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
1a:77:66:7a:13:85:56:f1:95:85:ec:08:7e:e3:64:e7:fb:65:6c:cd:29:10:4e:2a:7b:7d:5e:35:0d:59:41:86Signer
Actual PE Digest1a:77:66:7a:13:85:56:f1:95:85:ec:08:7e:e3:64:e7:fb:65:6c:cd:29:10:4e:2a:7b:7d:5e:35:0d:59:41:86Digest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetLastError
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetClipboardData
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
RegSetValueExA
shell32
ShellExecuteExW
ole32
CoTaskMemFree
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 162KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.8MB - Virtual size: 5.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 149KB - Virtual size: 148KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ