openNullFunc
Behavioral task
behavioral1
Sample
462fa324d07d5b3766e048733922975c.dll
Resource
win7-20231215-en
General
-
Target
462fa324d07d5b3766e048733922975c
-
Size
5.6MB
-
MD5
462fa324d07d5b3766e048733922975c
-
SHA1
3c17003607e171129164d04d0ef2b1ffe595dda6
-
SHA256
f66e87851bc64fca994135efc65daaf75f8b43d67f66a3e6772c16b5eea90d30
-
SHA512
ae998564a1458cbb79837cd6a3e51196aac9d4b760b317858129d1a87cdca482e52c2f3a8b39398f9d3442ea5b3e808e003affdea10440f98788726ee4b0cb14
-
SSDEEP
98304:GA/t7KsB2WqqpofQ8Mfbpl5LL30TioCsnI6mzkz23iow:GkKUPDQvMfbpjwTV1I6mzvfw
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 462fa324d07d5b3766e048733922975c
Files
-
462fa324d07d5b3766e048733922975c.dll windows:5 windows x86 arch:x86
faa0798e3d4901a99c877960894aa54c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
shlwapi
StrToIntExW
version
GetFileVersionInfoSizeA
user32
GetMessageTime
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
RectVisible
ole32
OleFlushClipboard
wininet
InternetTimeToSystemTime
oleaut32
VariantInit
psapi
GetProcessImageFileNameA
oledlg
ord8
winspool.drv
ClosePrinter
advapi32
RegSetValueExA
comctl32
ord17
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 315KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 640B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ