Behavioral task
behavioral1
Sample
08cef27851698160f2a7bd87a98e3eb2.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
08cef27851698160f2a7bd87a98e3eb2.exe
Resource
win10v2004-20231215-en
General
-
Target
08cef27851698160f2a7bd87a98e3eb2
-
Size
1.5MB
-
MD5
08cef27851698160f2a7bd87a98e3eb2
-
SHA1
a8e41c4a29c7d58c67bbaa1ed8f374710088519a
-
SHA256
e53df70f5a91e05d886929df4502e2d79a29a31a6bfeaeffa5e1c2a962fb9d55
-
SHA512
a3f5851f42067353f0f87a315cbf127619ecdc73c1f25280fe3c33ed6767be9467550647d811f456f3dd3c70aba788be516845621efa8985152922396d9c3279
-
SSDEEP
24576:Y7okKGbzWEJzF0sl+d1S2VEB1YSoblyJoi2Dmy+DFMC8DPUlqmalOLqSN/8d+3:Y7X7Xx0sl+d8Yi6yJP2DADFMZZmXLqZS
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 08cef27851698160f2a7bd87a98e3eb2
Files
-
08cef27851698160f2a7bd87a98e3eb2.exe windows:5 windows x86 arch:x86
54cedf46a1599053e69bc44dd945866d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetVersion
GetLocalTime
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
UnhookWindowsHookEx
advapi32
CryptGetHashParam
shell32
SHGetSpecialFolderPathA
ole32
CLSIDFromProgID
gdi32
RectVisible
comctl32
ImageList_GetIconSize
wininet
InternetCrackUrlA
gdiplus
GdipSetInterpolationMode
shlwapi
PathFindExtensionA
dbghelp
MakeSureDirectoryPathExists
imm32
ImmGetContext
oledlg
ord8
oleaut32
VariantClear
rasapi32
RasGetConnectStatusA
winspool.drv
DocumentPropertiesA
wsock32
closesocket
Sections
.text Size: - Virtual size: 757KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 682KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 827KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 56KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE