Behavioral task
behavioral1
Sample
fa0aeb70eb9e8b2df27aa056815c5e96.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
fa0aeb70eb9e8b2df27aa056815c5e96.exe
Resource
win10v2004-20231222-en
General
-
Target
fa0aeb70eb9e8b2df27aa056815c5e96
-
Size
112KB
-
MD5
fa0aeb70eb9e8b2df27aa056815c5e96
-
SHA1
c2893cacae909558e02e1edc277b219c66b5db61
-
SHA256
74928c8effd6e342d89a083ad31f1857e4284f2878caa94940f2e3c68c5e17a1
-
SHA512
eef16bed0bc341442c7e45aa4a1f62884fc35e29635fca5e36d47d93391d8b810f6725b2e974a76a9391a01164e9575a2d46a5dffb072a2856b31dd9fa0682e3
-
SSDEEP
3072:nOYY3rfB0aVgr8KdKcLe6k5Rt+kp5DOCeG962roACB:lY3N0rNAcLvo+oDOS96cU
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fa0aeb70eb9e8b2df27aa056815c5e96
Files
-
fa0aeb70eb9e8b2df27aa056815c5e96.exe windows:4 windows x86 arch:x86
2d435110eb467e742b3de3720ba27f8e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateMutexA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
ShowWindow
MessageBoxA
advapi32
RegQueryValueExA
ws2_32
closesocket
msvcrt
_except_handler3
iphlpapi
GetIfTable
Sections
.text Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.IsStop Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 100KB - Virtual size: 98KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ