openNullFunc
Behavioral task
behavioral1
Sample
32b60218ba38edb80b6fddaddfdd55de.dll
Resource
win7-20231215-en
General
-
Target
32b60218ba38edb80b6fddaddfdd55de
-
Size
5.6MB
-
MD5
32b60218ba38edb80b6fddaddfdd55de
-
SHA1
54d34db2b783b62c72ec8f60c596a02abf9e507b
-
SHA256
657adb75aae143a6f3026be0c05779da771646cda870527bf31d0bfefa732a4f
-
SHA512
e9d9026d7a44da77a61da77817c0d9ad56e273a0d50ec1fda80a6d2627a16864436bc683954fabc4dead4f848f30608d0a98adbd158e74df7c53dc1b3bf2db3d
-
SSDEEP
98304:3MiBLan3rgEUpprmZqJsEyTtjahSA1MR/0+4pnw718EGfUPzQm7XLtNqj:3M53rp+rmYQTUUPR3owB803X
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 32b60218ba38edb80b6fddaddfdd55de
Files
-
32b60218ba38edb80b6fddaddfdd55de.dll windows:5 windows x86 arch:x86
7208f928d78c39e2ca11f282d3e2147f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
shlwapi
StrToIntW
ws2_32
setsockopt
version
GetFileVersionInfoSizeA
user32
GetDlgItem
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
SetTextColor
ole32
CLSIDFromProgID
psapi
GetProcessImageFileNameA
oledlg
ord8
oleaut32
SafeArrayDestroy
winspool.drv
ClosePrinter
advapi32
RegSetValueExA
comctl32
ord17
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 316KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 640B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ