Behavioral task
behavioral1
Sample
2675206348e095efe5a7ce05e6618533.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2675206348e095efe5a7ce05e6618533.exe
Resource
win10v2004-20231215-en
General
-
Target
2675206348e095efe5a7ce05e6618533
-
Size
1016KB
-
MD5
2675206348e095efe5a7ce05e6618533
-
SHA1
90a6a87f896efd6b756d543915a14ad5dd0dbe4c
-
SHA256
e00f91181bb4217ec3cbd89b758655572c79efc7d9d6e0ac062bcaf624869502
-
SHA512
3518629559a2654d096f9eb8c17412a9d69327463ad4f8aa4a5486649e1a6432fdca99d34e25745ab411734c1780c73f4ee6f3ab08413b2e8bd66324274d2ae0
-
SSDEEP
24576:DQS6cL/x2TaQAGAp7Sb+qmAQcw4g11dgEL:k9cL/x2TaQ3A0gVcwJL
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2675206348e095efe5a7ce05e6618533
Files
-
2675206348e095efe5a7ce05e6618533.exe windows:4 windows x86 arch:x86
ab00b6eb7beab895573c3222a1dd2610
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasHangUpA
kernel32
WideCharToMultiByte
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetCapture
MessageBoxA
gdi32
ScaleViewportExtEx
winmm
midiStreamRestart
winspool.drv
OpenPrinterA
advapi32
RegCloseKey
shell32
ShellExecuteA
ole32
CoRegisterMessageFilter
oleaut32
VariantChangeType
comctl32
ImageList_Destroy
oledlg
ord8
ws2_32
WSAAsyncSelect
wininet
InternetCanonicalizeUrlA
comdlg32
ChooseColorA
Sections
.text Size: - Virtual size: 624KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 194KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 175KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 72KB - Virtual size: 85KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 465KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 940KB - Virtual size: 938KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE