Behavioral task
behavioral1
Sample
0bd4b7953757bceb3f3c451332be1e2c.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0bd4b7953757bceb3f3c451332be1e2c.exe
Resource
win10v2004-20231215-en
General
-
Target
0bd4b7953757bceb3f3c451332be1e2c
-
Size
547KB
-
MD5
0bd4b7953757bceb3f3c451332be1e2c
-
SHA1
7b19dfd47b9190421bfa7c7c039c540639503d50
-
SHA256
50ab4de45941d7f6fd1a0401aa8c63bd410f2fd76a0e080bdaa7de5400437184
-
SHA512
457d8b7704b62c697754136e245cad24782a863b26a3a12eacc7a0a65a9cc2b5520489e0bc7588d58187d105e032bd771ff2557298ce8092b5bdeb624e11a54d
-
SSDEEP
12288:R7QZ2cmiplfUxYFaJgi7V3OKu2qplDuEpkVWPsL:NOllUSaOeOK6BxKesL
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0bd4b7953757bceb3f3c451332be1e2c
Files
-
0bd4b7953757bceb3f3c451332be1e2c.exe windows:1 windows x86 arch:x86
6b76ae1aad2b2f668fb084d1d523c3d0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
urlmon
URLDownloadToFileA
shell32
ShellExecuteA
kernel32
InterlockedIncrement
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CharUpperBuffW
Sections
.data Size: - Virtual size: 302B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.code Size: - Virtual size: 222B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.idata Size: - Virtual size: 460B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 512B - Virtual size: 128B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 546KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 546KB - Virtual size: 545KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE