Behavioral task
behavioral1
Sample
6f750a718bb2a04f159e61438f00e657.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
6f750a718bb2a04f159e61438f00e657.exe
Resource
win10v2004-20231215-en
General
-
Target
6f750a718bb2a04f159e61438f00e657
-
Size
990KB
-
MD5
6f750a718bb2a04f159e61438f00e657
-
SHA1
4357852f414f34bf04aa0f7bae1b86b859a81083
-
SHA256
f087cf309cfcffbd1a5ce5da8f95d57ea06b1298ba99aac8cde22fca699c3ae7
-
SHA512
dd02a871b4467a6dc31ca164b726adecdd366376a0483258ce8d60edc5d423c053443afb00064b4ebb20955f87612ed180970e07c64d1aae5716be219758a4c4
-
SSDEEP
24576:v94Y/v2VmZIXFPi2rV/gRLvClQW03CHnqxGAuC:2drZVoRL+QW06nqxB9
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6f750a718bb2a04f159e61438f00e657
Files
-
6f750a718bb2a04f159e61438f00e657.exe windows:5 windows x86 arch:x86
d0e4c26615632a2d8343b4dde3aa32a9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
FreeSid
kernel32
GetLastError
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
GetDeviceCaps
user32
EnableWindow
MessageBoxA
comctl32
ord17
version
VerQueryValueA
Sections
.text Size: - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 13KB - Virtual size: 792KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 71KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp1 Size: 976KB - Virtual size: 975KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE