Behavioral task
behavioral1
Sample
262fa3da830ad6f01df11f471278a5c4.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
262fa3da830ad6f01df11f471278a5c4.dll
Resource
win10v2004-20231215-en
General
-
Target
262fa3da830ad6f01df11f471278a5c4
-
Size
744KB
-
MD5
262fa3da830ad6f01df11f471278a5c4
-
SHA1
e02f77aaccf2b6632d19e9d825980dd2d824f6d3
-
SHA256
f58abd97dea9da5eedd5c233d6e1cc432b95b99d8b7f172eefcbb7d980823d17
-
SHA512
ecb198cd921af6cbe9bed2c876dc6f2fc15c0a0831ab142cfa4f4f87c9f1f798e9145deaaac5270e17942bfc7c333d8e975b3f18d0137128d3420e9d18b9c081
-
SSDEEP
12288:05rYsdDXKZz2dhTBSBworUS56yOLqD22AGKLyEYPfhy4R6w5o2o8:01tdDXKZWh9SBwo76Wn0+xyhwKx8
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 262fa3da830ad6f01df11f471278a5c4
Files
-
262fa3da830ad6f01df11f471278a5c4.dll windows:4 windows x86 arch:x86
750b373fb30a6f06ecabf83842a118ed
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetVersionExA
GetVersion
GetVersionExA
GetVersion
MultiByteToWideChar
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
WinHelpA
advapi32
LookupPrivilegeValueA
oleaut32
VariantClear
version
VerQueryValueA
gdi32
CreateDIBSection
ole32
IsAccelerator
comctl32
ImageList_GetBkColor
shell32
ExtractIconA
wininet
DeleteUrlCacheEntry
urlmon
UrlMkGetSessionOption
wsock32
recvfrom
oleacc
AccessibleObjectFromWindow
ntdll
NtAllocateVirtualMemory
powrprof
CallNtPowerInformation
gdiplus
GdipAlloc
iphlpapi
GetExtendedTcpTable
imagehlp
MapFileAndCheckSumA
atl
AtlAxGetControl
psapi
GetProcessImageFileNameW
rpcrt4
UuidCreateSequential
Sections
CODE Size: - Virtual size: 775KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 14KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 738KB - Virtual size: 737KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 168B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ