Behavioral task
behavioral1
Sample
353ff2e9ea0bd7c4aef52a6e97203eca.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
353ff2e9ea0bd7c4aef52a6e97203eca.exe
Resource
win10v2004-20231215-en
General
-
Target
353ff2e9ea0bd7c4aef52a6e97203eca
-
Size
4.8MB
-
MD5
353ff2e9ea0bd7c4aef52a6e97203eca
-
SHA1
9c3643b0c9a307344f315c26b9e4c55b81884587
-
SHA256
f914d5adb55e8a535e48e6d02b987c05b3b9471ec0cf33756c2029c4145cd988
-
SHA512
818f728dabcdaa321d93bb6310ebb2f466d9e0ce9124157874f4791c683c1e8cabc14789584d071877624987f2818bfae59a7bb1705f70ea999d7fc58212fc5c
-
SSDEEP
98304:yEUT1j6aSywz9y1qrpmJhhhevgTir8Trk/MmSFsun:yEUhj63z9EqNQE4i4f9
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 353ff2e9ea0bd7c4aef52a6e97203eca
Files
-
353ff2e9ea0bd7c4aef52a6e97203eca.exe windows:5 windows x86 arch:x86
9c34eadef30b0a0712e67a0cbd43b2b7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
advapi32
FreeSid
msvcrt
_iob
ws2_32
WSARecv
wsock32
getsockopt
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Sections
.text Size: - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 4.8MB - Virtual size: 4.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ