Behavioral task
behavioral1
Sample
04c440513f9dff30890dc9c4298464b3.exe
Resource
win7-20231129-en
General
-
Target
04c440513f9dff30890dc9c4298464b3
-
Size
2.1MB
-
MD5
04c440513f9dff30890dc9c4298464b3
-
SHA1
f04c979d265ce851b4b001c75ebab289cac6e6c9
-
SHA256
b06eaeb60ff8099c586e28557da8b463b135113f49fecb4d1d0d1e81297ab6fd
-
SHA512
0f79c376f77bdae60558b56ca16ec7e3696215fb2629184d98ef8131dd4d5ed383a6d14b77cfdb4de1293d536c70db542b33c5a964331e4804041c7767cadcdf
-
SSDEEP
49152:uQbC0+179VaQusd8I7DmKB8r4K7EXbg296mdqdWunf:uOF+h9VRZKKqr5+gYdhW
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 04c440513f9dff30890dc9c4298464b3
Files
-
04c440513f9dff30890dc9c4298464b3.exe windows:4 windows x86 arch:x86
11cbdfb47fdc9152560598c88ea044f0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GlobalLock
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
LoadCursorA
MessageBoxA
advapi32
RegEnumKeyExA
ole32
CoTaskMemRealloc
oleaut32
SysStringLen
gdi32
GetStockObject
ntdll
RtlFreeHeap
Sections
.text Size: - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 168KB - Virtual size: 2.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 67KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 172B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ