drm_pagui_doit
Behavioral task
behavioral1
Sample
3b83cb8ec6d523c54709ede08599298d.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3b83cb8ec6d523c54709ede08599298d.dll
Resource
win10v2004-20231215-en
General
-
Target
3b83cb8ec6d523c54709ede08599298d
-
Size
528KB
-
MD5
3b83cb8ec6d523c54709ede08599298d
-
SHA1
a455b975326e0068a0538e14e529a1ee3d22d8b9
-
SHA256
e9be9b0703c566893f448bf5d63d3ffc8737f204900fb161b32dee0264316b90
-
SHA512
f4cc7c52c95855a9a3073f9c139559adc942c41c297c852d6403e5c6201dcfa47600c280361a55a59cf732f3fdd4074e0374dba2a7810cf5d16b58ecad0ec265
-
SSDEEP
12288:L0n8qdKS6Ev8J+3GCehOdQEvE+lTFoqSzt3R2nGRjzLJsOR7ayeJP26:wn8q4gv8J0GhOdxFoqAtYnGJeOJafJPF
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3b83cb8ec6d523c54709ede08599298d
Files
-
3b83cb8ec6d523c54709ede08599298d.dll windows:4 windows x86 arch:x86
ac093fdf9d82d04de08d2a24bc591670
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
version
GetFileVersionInfoW
kernel32
WriteConsoleA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetPropW
gdi32
OffsetViewportOrgEx
winspool.drv
DocumentPropertiesW
advapi32
RegOpenKeyExW
shell32
ShellExecuteW
shlwapi
PathFindExtensionW
oleaut32
SysAllocString
Exports
Exports
Sections
.text Size: - Virtual size: 234KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 346KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp2 Size: 508KB - Virtual size: 505KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 160B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ