Behavioral task
behavioral1
Sample
7ab191e1cef2a4882cf92da3534e846d.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
7ab191e1cef2a4882cf92da3534e846d.exe
Resource
win10v2004-20231215-en
General
-
Target
7ab191e1cef2a4882cf92da3534e846d
-
Size
1.2MB
-
MD5
7ab191e1cef2a4882cf92da3534e846d
-
SHA1
984aeef18fb4940710d44f02fb777553c6087d6f
-
SHA256
deb83e3ee0ad28607dcee35b17c179399aa0a13dadf85820cd9e72cc0e0710ed
-
SHA512
432fa5149e1f7d208dc6952d07f57b43bf836884ade9240d73ececef946c13c739f63d726cd11a254a841657d601b9caf6a3eae2e3dd3ded8175f8622c49405a
-
SSDEEP
24576:EbynYMFDByRahtgZyc8usu6GEJtiyUK7uTWdbw79wktjmz:EbyYkYgtjuskMt+K7g0wR9j4
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7ab191e1cef2a4882cf92da3534e846d
Files
-
7ab191e1cef2a4882cf92da3534e846d.exe windows:5 windows x86 arch:x86
6aad3c30fdfc639d219444e8d4828810
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
_CIcos
wtsapi32
WTSSendMessageW
kernel32
LoadLibraryA
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
user32
CharUpperBuffW
advapi32
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
Sections
.text Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ