Behavioral task
behavioral1
Sample
5ffb3994eeca28fe0989b93b36833594.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5ffb3994eeca28fe0989b93b36833594.dll
Resource
win10v2004-20231215-en
General
-
Target
5ffb3994eeca28fe0989b93b36833594
-
Size
79KB
-
MD5
5ffb3994eeca28fe0989b93b36833594
-
SHA1
aaef8e4a99acd205040ffe71be146447bdb13a30
-
SHA256
e5725a96b6aac94559dbd52916e70e2ce1a5a30113f9a9caab6d742476534e75
-
SHA512
bae538ac830677844874749571b7a655a259fe718c5d82d59c3e9df5479b780cb36e0defe7b3181c7726172ec4dee2b2256cacec077d25f622630f1386ebef2b
-
SSDEEP
1536:pfHgUMKfe+eyycuNTLTxa9Un0PA9ZRiIOUTxJoXT3Z7NV2Ov3gHDiSNOFmjyd:hHgUMKfe+eyycuRta9Un0PAvkWveTBNb
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5ffb3994eeca28fe0989b93b36833594
Files
-
5ffb3994eeca28fe0989b93b36833594.dll windows:5 windows x86 arch:x86
015b14044067f0da4c5b1e9a710777d1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
Sleep
DisableThreadLibraryCalls
CreateThread
VirtualProtect
GetTimeFormatA
GetModuleHandleA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
InterlockedCompareExchange
InterlockedExchange
TerminateProcess
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
SetRect
GetDesktopWindow
GetAsyncKeyState
d3d9
Direct3DCreate9
d3dx9_43
D3DXCreateFontA
msvcr90
_encode_pointer
vsprintf_s
free
_encoded_null
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
malloc
system
_malloc_crt
memset
Sections
.text Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 30KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ