Behavioral task
behavioral1
Sample
36cc5248222eebaa0bf6d7c054ae5174.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
36cc5248222eebaa0bf6d7c054ae5174.exe
Resource
win10v2004-20231215-en
General
-
Target
36cc5248222eebaa0bf6d7c054ae5174
-
Size
1.2MB
-
MD5
36cc5248222eebaa0bf6d7c054ae5174
-
SHA1
f67e53485c2f347dad9a05a38556781718bd6bac
-
SHA256
f90e1c9e6b95781e92f7f8a215ec407d0dd6eff462919e12b0e7087fb1bc1468
-
SHA512
25471a3132fb169ddf8c8e95e57a36beaf41160714b5b6fcb1bd1b55712894cb8e021bd34becdaa3cb56a000abf6af9021c34f935bbf00f777e9895000c1fb7f
-
SSDEEP
24576:N7lKJGonNEiuuJIQpK20uMqMsWTwRnfnri+EAPHijNTxnsQ1MgbX:ZkI1SK2GqMsyw/rJEeALy
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 36cc5248222eebaa0bf6d7c054ae5174
Files
-
36cc5248222eebaa0bf6d7c054ae5174.exe windows:4 windows x86 arch:x86
a178996e3dcff21538ddbe08ff0d5b35
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasGetConnectStatusA
kernel32
GlobalHandle
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CopyAcceleratorTableA
MessageBoxA
gdi32
CreateFontIndirectA
winmm
midiOutReset
winspool.drv
OpenPrinterA
advapi32
RegSetValueExA
shell32
Shell_NotifyIconA
ole32
OleInitialize
oleaut32
VariantTimeToSystemTime
comctl32
ImageList_Destroy
oledlg
ord8
ws2_32
send
wininet
InternetCanonicalizeUrlA
comdlg32
ChooseColorA
Sections
.text Size: - Virtual size: 495KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 843KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 174KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 104KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 429KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE