Behavioral task
behavioral1
Sample
2caf8f55c0544d96e8815b0e19d9f265.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2caf8f55c0544d96e8815b0e19d9f265.exe
Resource
win10v2004-20231215-en
General
-
Target
2caf8f55c0544d96e8815b0e19d9f265
-
Size
3.9MB
-
MD5
2caf8f55c0544d96e8815b0e19d9f265
-
SHA1
61875bc3e10459201e0d668eeb980795eb3cdc63
-
SHA256
fc5fae90257354e42db717247d349b5dd79065fe3d35d38fc417a6b7d6412cb4
-
SHA512
98ea44e972f0cca99311474ac987fad5c31d061174b3839f65a8e14ed3b9ede4f558abaffa25e89e044cec2802cb064e35bd7514c2579bb83b9acbdb77069cb5
-
SSDEEP
98304:lvuK8Th1JVGFWGiqbnPsxVdKJYKaQkWbxGxQPiUYhj:lv38rJpobg9QbGxFUA
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2caf8f55c0544d96e8815b0e19d9f265
Files
-
2caf8f55c0544d96e8815b0e19d9f265.exe windows:5 windows x86 arch:x86
e86e5fea8267d7a1edc098906992b281
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
MapViewOfFile
VirtualProtect
ExitProcess
user32
CloseClipboard
gdi32
GetTextExtentPointW
msimg32
TransparentBlt
comdlg32
GetFileTitleW
winspool.drv
GetJobW
advapi32
OpenThreadToken
shell32
ExtractIconW
comctl32
InitCommonControlsEx
shlwapi
PathIsUNCW
ole32
OleSaveToStream
oleaut32
SafeArrayGetDim
oledlg
OleUIInsertObjectW
gdiplus
GdipCreateBitmapFromHBITMAP
ws2_32
WSAStartup
wininet
InternetCrackUrlW
oleacc
LresultFromObject
imm32
ImmReleaseContext
winmm
PlaySoundW
msvcrt
strncpy
iphlpapi
GetInterfaceInfo
psapi
GetMappedFileNameW
Sections
.text Size: - Virtual size: 6.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sedata Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sedata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
.vmp1 Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 765KB - Virtual size: 765KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ