Behavioral task
behavioral1
Sample
032664e68c189d026df59a18b525f041.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
032664e68c189d026df59a18b525f041.exe
Resource
win10v2004-20231215-en
General
-
Target
032664e68c189d026df59a18b525f041
-
Size
484KB
-
MD5
032664e68c189d026df59a18b525f041
-
SHA1
4e3b38f4ff1854d7e681a9c60948c7e49bd813d4
-
SHA256
6964a864275428bacbbbe90cec39708ca99850f641ddfa9e180e563bbdfaa7b8
-
SHA512
e3ea41c52b64a7278b9f43f2b93d2496af1916b2baa27c23c994c9d762e7dfa6ef0d6576cfa950f2680e581346c9071b346b03a8f94ac185ecd5e907561dedc1
-
SSDEEP
12288:PVjMYQiuPNqK0lbM+0ZGwxFs/2SVqDyt0WyeqU:PVjMPiOqtM+0ZZrserDSyeqU
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 032664e68c189d026df59a18b525f041
Files
-
032664e68c189d026df59a18b525f041.exe windows:4 windows x86 arch:x86
ce472f9e68ef8e03ad4a9ee03c8581c3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasGetConnectStatusA
kernel32
SetLastError
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
DispatchMessageA
MessageBoxA
gdi32
CreateBitmap
wsock32
gethostbyname
wininet
InternetOpenUrlA
advapi32
LsaOpenPolicy
shell32
ShellExecuteA
ole32
CoRevokeClassObject
winmm
timeSetEvent
shlwapi
PathFileExistsA
atl
ord47
dbghelp
MakeSureDirectoryPathExists
gdiplus
GdipCreateBitmapFromStream
oledlg
ord8
oleaut32
LHashValOfNameSys
winspool.drv
OpenPrinterA
comctl32
ord17
Sections
.text Size: - Virtual size: 566KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 330KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 167KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 476KB - Virtual size: 472KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 168B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ