Behavioral task
behavioral1
Sample
fefd30308f73092c122fe29921534fbeea6659c32dfd68fe234bcdbabdf8d1ec.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
fefd30308f73092c122fe29921534fbeea6659c32dfd68fe234bcdbabdf8d1ec.exe
Resource
win10-20231220-en
General
-
Target
fefd30308f73092c122fe29921534fbeea6659c32dfd68fe234bcdbabdf8d1ec
-
Size
6.5MB
-
MD5
8fc868f86ee50172a6135d3a58d3495f
-
SHA1
b26cd7a4ca5229e05e51068852539549b3838738
-
SHA256
fefd30308f73092c122fe29921534fbeea6659c32dfd68fe234bcdbabdf8d1ec
-
SHA512
36fad19ee3f5a11cc1300d67cc59355bf2a2452cd89b75e5aa80aa2b893b63b0ed6acfb7dfe5fbd66170911c7e00602514965de2c24012c1d27bffa551aab2c7
-
SSDEEP
98304:oLRKr2ABiBQPGrOr17nGPVzN1iiriD0dbZHX7rYEnpMoC1y5EHuj4QdrwDOuL:oL5ABRPGSrlnGPVH7iDe0EpMoCSeuHG1
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
fefd30308f73092c122fe29921534fbeea6659c32dfd68fe234bcdbabdf8d1ec.exe windows:6 windows x86 arch:x86
7106f7f21b5a6e69fd7cbbc19f3ecd14
Code Sign
7d:d2:b3:07:cf:3e:50:82:4b:ca:c9:55:2f:7c:00:b9Certificate
IssuerCN=—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹Not Before18/12/2023, 20:00Not After19/12/2033, 20:00SubjectCN=—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹—‹�°~�@8~�\\—‹39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before03/05/2023, 00:00Not After02/08/2034, 23:59SubjectCN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02/05/2019, 00:00Not After18/01/2038, 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
4b:52:96:ab:94:a9:b4:a6:0f:0f:1f:bd:74:f7:9c:b7:5b:2b:b1:ee:8c:02:61:d3:c3:19:6f:8c:d3:85:22:76Signer
Actual PE Digest4b:52:96:ab:94:a9:b4:a6:0f:0f:1f:bd:74:f7:9c:b7:5b:2b:b1:ee:8c:02:61:d3:c3:19:6f:8c:d3:85:22:76Digest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetLastError
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetClipboardData
GetProcessWindowStation
GetUserObjectInformationW
advapi32
RegSetValueExA
shell32
ShellExecuteExW
ole32
CoTaskMemFree
Sections
.text Size: - Virtual size: 162KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.7z.◄� Size: - Virtual size: 971KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.7z.◄� Size: 1024B - Virtual size: 524B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.7z.◄� Size: 6.2MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 224KB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ