Behavioral task
behavioral1
Sample
f98d679c6609ab3ba3e0db3232b952d7.exe
Resource
win7-20231215-en
General
-
Target
f98d679c6609ab3ba3e0db3232b952d7
-
Size
14.9MB
-
MD5
f98d679c6609ab3ba3e0db3232b952d7
-
SHA1
75fb8edb714be1c41ff985f0b350c8355d0c9de3
-
SHA256
e37686327a80c054988f778c5fe7ed7a5cd22c4981e76ff492a37fd64f485c5a
-
SHA512
bbf9f0bc7f77a3fecee03d28cdf312702b74e7d6b0637db524885eb2b5123885a45176cb53e81a3aaf72442517f3c07f1bb9b264cf77af868aab05da1dbd8c87
-
SSDEEP
393216:yanw/3Jtti1NgnBkoWzgk/LEWGPq4mP+hMprrBzg7Yi:w/3I1mBOgkTvYRmPc2rrBzg0
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f98d679c6609ab3ba3e0db3232b952d7
Files
-
f98d679c6609ab3ba3e0db3232b952d7.exe windows:5 windows x86 arch:x86
3765197ffa9953fe01854e2ec2771415
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
iphlpapi
GetAdaptersInfo
winmm
midiStreamOpen
ws2_32
__WSAFDIsSet
msvfw32
DrawDibDraw
avifil32
AVIStreamGetFrame
rasapi32
RasGetConnectStatusA
kernel32
GlobalHandle
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CharNextA
gdi32
GetClipBox
winspool.drv
ClosePrinter
comdlg32
ChooseColorA
advapi32
RegCreateKeyA
shell32
Shell_NotifyIconA
ole32
CoRegisterMessageFilter
oleaut32
LoadTypeLi
comctl32
ImageList_DragEnter
oledlg
ord8
wininet
InternetSetOptionA
Sections
.text Size: - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 650KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 9.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 14.8MB - Virtual size: 14.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 100KB - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ