Behavioral task
behavioral1
Sample
026d81169c85ae3baf58987c3c758574.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
026d81169c85ae3baf58987c3c758574.dll
Resource
win10v2004-20231215-en
General
-
Target
026d81169c85ae3baf58987c3c758574
-
Size
148KB
-
MD5
026d81169c85ae3baf58987c3c758574
-
SHA1
30ea0ae012741709cd7406ddfb076fc768382302
-
SHA256
3f1cb8069ec92f4e1534c3c99ac0f3cd569e10eafb83212967694614c9f54c77
-
SHA512
f4eeb5b1ac0c3439b5d45bf6b869d90231eaa195e75ab567f89dc7224518fddc14da58a129b225677739ad4e8bcfe3eea5c6712bda9e1c53cb4ba670be49d05d
-
SSDEEP
3072:2fLbOcna4K4l6Y0/u2CqEXjCsu5M9gdITcZL2uEA0Z2hKAzAYC:2DqcnrK490xezCdUgITcpDhKZ
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 026d81169c85ae3baf58987c3c758574
Files
-
026d81169c85ae3baf58987c3c758574.dll windows:4 windows x86 arch:x86
6f8909ec805284b1363ad2188e47e40d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
OpenFileMappingA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetDC
gdi32
CreateFontA
advapi32
RegOpenKeyA
Sections
.text Size: - Virtual size: 115KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sxdata Size: - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 45KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 140KB - Virtual size: 137KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 196B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ