Behavioral task
behavioral1
Sample
108c86de210b7f9c2fdd68cd795297fb.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
108c86de210b7f9c2fdd68cd795297fb.exe
Resource
win10v2004-20231215-en
General
-
Target
108c86de210b7f9c2fdd68cd795297fb
-
Size
1.2MB
-
MD5
108c86de210b7f9c2fdd68cd795297fb
-
SHA1
b18720515db9e9387685e37a54c039f54284c610
-
SHA256
e3285185f37ef1073114bca3c93c7ffe16844aa68d0910a1542b59412513a908
-
SHA512
02d26fda9ad4102b12ff995ca7cacd69937875d92d41c29751a54d244b10c9c976057f9842aa0b89271447549354aa403fff9564fa30b09e021cc123a0e216c7
-
SSDEEP
24576:eXJU85d9CGA2zG1JnIL3G9MjODHu3MaJnpZo0MJMvsJnoxHglfZgiJI2A/l+cs5:QJFDfA2zG7C3GaODOlJnTjs65glfZX0a
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 108c86de210b7f9c2fdd68cd795297fb
Files
-
108c86de210b7f9c2fdd68cd795297fb.exe windows:4 windows x86 arch:x86
194855d2d5394fd77456204d14b87061
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamProperty
ws2_32
recvfrom
kernel32
FindClose
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
GetWindowRect
gdi32
LineTo
winspool.drv
ClosePrinter
advapi32
RegQueryValueA
shell32
ShellExecuteA
ole32
StgOpenStorageOnILockBytes
oleaut32
VariantClear
comctl32
ImageList_Destroy
oledlg
ord8
comdlg32
GetFileTitleA
Sections
.text Size: - Virtual size: 493KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 259KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 104KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 365KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE