Behavioral task
behavioral1
Sample
abfd04211fefb288700bda8ded62e7041b5b43eabf017394e9f411eac7aaa9a2.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
abfd04211fefb288700bda8ded62e7041b5b43eabf017394e9f411eac7aaa9a2.exe
Resource
win10v2004-20231222-en
General
-
Target
abfd04211fefb288700bda8ded62e7041b5b43eabf017394e9f411eac7aaa9a2
-
Size
4.3MB
-
MD5
1ab573032537895e0d23094a410e3434
-
SHA1
8fa7f02626517cd696d95e7b9f2930b8d688e662
-
SHA256
abfd04211fefb288700bda8ded62e7041b5b43eabf017394e9f411eac7aaa9a2
-
SHA512
13ec5e265dad56e82e04cca022dde525edbace580485cd1d9d6f70fa9878616c8c41a99a9d84822bb7a8232c7bf1d661dae1b6c355685efe436b24424efe1541
-
SSDEEP
98304:fQzl3f9IhIJdoydGefu+L4dnm5vQZvB+cJkjgMO:EPKhIJdoGlm+v5vmv9
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource abfd04211fefb288700bda8ded62e7041b5b43eabf017394e9f411eac7aaa9a2
Files
-
abfd04211fefb288700bda8ded62e7041b5b43eabf017394e9f411eac7aaa9a2.exe windows:5 windows x86 arch:x86
fcbd2f194791eaf09fe7ce0cfe70dd1f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetVersion
MapViewOfFile
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CreatePopupMenu
gdi32
RectVisible
winmm
midiStreamOut
winspool.drv
DocumentPropertiesA
advapi32
RegCreateKeyExA
shell32
ShellExecuteA
ole32
ReleaseStgMedium
oleaut32
SysAllocString
comctl32
ImageList_Create
ws2_32
recvfrom
wldap32
ord29
comdlg32
GetOpenFileNameA
Sections
.text Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 377KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 4.2MB - Virtual size: 4.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 88KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ