Behavioral task
behavioral1
Sample
12月.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
12月.exe
Resource
win10v2004-20231215-en
General
-
Target
854ef59957b1e303656ecd5ec175d89490c3d53928ed220850b53a13ba09a40d
-
Size
5.2MB
-
MD5
96fa49d76e8b1307c3ce67502567ae0a
-
SHA1
7040a912586938e2a80c033aa61d35ba7ef1a05c
-
SHA256
854ef59957b1e303656ecd5ec175d89490c3d53928ed220850b53a13ba09a40d
-
SHA512
3f2782cff9ac098c5b976ed71380dd2dac53bc8269b60d3de275040e89dde241ddd68a85e72bdb93be74e07acdaaca087500c8fced403c73f52faf79176bac65
-
SSDEEP
98304:7+v9E+l/dvuuK0RPDwJl+hw2QSnp38UM9zw/dG8puaVsjVcJpd:7+vl/dLwJl+pp38UkL8UNjVk
Malware Config
Signatures
-
resource yara_rule static1/unpack001/12月.com vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/12月.com
Files
-
854ef59957b1e303656ecd5ec175d89490c3d53928ed220850b53a13ba09a40d.zip
-
12月.com.exe windows:5 windows x86 arch:x86
9f35cc034966c27b4c592aae396abb7e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
ws2_32
recv
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Sections
.text Size: - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.3MB - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ