Behavioral task
behavioral1
Sample
308b3ee5afb967a4b4d97e80e8de9b9b.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
308b3ee5afb967a4b4d97e80e8de9b9b.exe
Resource
win10v2004-20231215-en
General
-
Target
308b3ee5afb967a4b4d97e80e8de9b9b
-
Size
7.0MB
-
MD5
308b3ee5afb967a4b4d97e80e8de9b9b
-
SHA1
8fa3f0e37be0ae7178e12fbf1b8172dc5d64692f
-
SHA256
be7e9ca4df87a899bbe0d3e9b880f90f6da66b0fd95bf991b7533c5c5c0890d2
-
SHA512
3889b3b5d88a86a83bac2604fb48361c03019c4eed653fc45161d23106a5beccdb530f102d1cdb2f5a9d9ba62f421824de529f2b84563b8cd0bac33953113b55
-
SSDEEP
196608:jkWCnB0b0XCXcMrRLUX+LP6OPsZfB/bp1fOX5:gWGBY7sE+O0NjNOJ
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 308b3ee5afb967a4b4d97e80e8de9b9b
Files
-
308b3ee5afb967a4b4d97e80e8de9b9b.exe windows:6 windows x64 arch:x64
e443fed70717ab94b9b1bde37d604d67
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetProcAddress
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowLongA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
ConvertSidToStringSidA
shell32
ShellExecuteW
ws2_32
ioctlsocket
wldap32
ord26
crypt32
CertOpenStore
userenv
UnloadUserProfile
rpcrt4
UuidCreate
ntdll
RtlCaptureContext
urlmon
URLDownloadToFileA
bcrypt
BCryptGenRandom
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 797KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 334KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 101KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 7.0MB - Virtual size: 7.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ