Behavioral task
behavioral1
Sample
943d47d83fd5241dd08f4dacf05436dd.exe
Resource
win7-20231215-en
General
-
Target
943d47d83fd5241dd08f4dacf05436dd
-
Size
950KB
-
MD5
943d47d83fd5241dd08f4dacf05436dd
-
SHA1
1babac86e0a9f8852849a9bf3f281b85fdd86f84
-
SHA256
1108d913b6d546b87ce79dc76886a70311e11dd96f9ebf0e71b4e14022e67f0f
-
SHA512
3e49f4914dbba02bc75818d701202e262917dd29db2ff19c657361a1183ac25d45f864aca4598481e83183a709a124cae72a16d7adab8b24ceb3584ac72f03ac
-
SSDEEP
12288:Pivo6XvOrZfr+oeVcmx+l55/E6kFEREcyaf9bKRJVZVlDB1rjOeMozBtV/fRo:atXYb4jrKMObMrhLdMozBtRfO
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 943d47d83fd5241dd08f4dacf05436dd
Files
-
943d47d83fd5241dd08f4dacf05436dd.exe windows:6 windows x86 arch:x86
cb1e3d91b9c7bae945b29f39b276e427
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapAlloc
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxW
MessageBoxA
advapi32
RegOpenKeyExW
shell32
SHGetSpecialFolderPathW
ole32
CoInitializeEx
ws2_32
WSAStartup
shlwapi
PathFileExistsW
winhttp
WinHttpQueryAuthSchemes
wininet
InternetQueryOptionW
quartz
AMGetErrorTextW
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 200KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 145KB - Virtual size: 145KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 803KB - Virtual size: 803KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 136B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ