Behavioral task
behavioral1
Sample
057ccd364f31750f0399877ce4f51a2b.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
057ccd364f31750f0399877ce4f51a2b.exe
Resource
win10v2004-20231215-en
General
-
Target
057ccd364f31750f0399877ce4f51a2b
-
Size
1.7MB
-
MD5
057ccd364f31750f0399877ce4f51a2b
-
SHA1
1b87ddf440df7ad74baa19d3e1a4572be6453a26
-
SHA256
dc5a55e3e9affb7e057620f030595ca4233095aa149f9f349e8ab61e99fcea3c
-
SHA512
86ee3a40d7c6616cda3fdeda6817ea74f8e3ae2ace76145e4e1cfdd03299a6687feb91fb5e5c345b6ae4669fbd1488900fa2eb58b9d811b526c9681a39d959d1
-
SSDEEP
24576:s7snn2mEUgi7O2WXfadG8CM4o/NtB9kHbrTq/n2X4kspAq7xHjjxsETG275Tbm54:ssn2Do7kydGRvEtB9Wq/2IB75tRfY5
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 057ccd364f31750f0399877ce4f51a2b
Files
-
057ccd364f31750f0399877ce4f51a2b.exe windows:4 windows x86 arch:x86
35326a0bcec523947c5685e8ab1bd35d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasGetConnectStatusA
iphlpapi
GetAdaptersInfo
winmm
midiStreamStop
ws2_32
accept
kernel32
LCMapStringA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetScrollPos
gdi32
CombineRgn
winspool.drv
DocumentPropertiesA
advapi32
RegDeleteValueA
shell32
ShellExecuteA
ole32
CLSIDFromString
oleaut32
RegisterTypeLi
comctl32
ord17
wininet
InternetOpenA
comdlg32
GetOpenFileNameA
Sections
.text Size: - Virtual size: 539KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 242KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 104KB - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 304KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp1 Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE