ServiceMain
Behavioral task
behavioral1
Sample
48c4dab6e5bea589a22fc80d095594e2.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
48c4dab6e5bea589a22fc80d095594e2.dll
Resource
win10v2004-20231222-en
General
-
Target
48c4dab6e5bea589a22fc80d095594e2
-
Size
76KB
-
MD5
48c4dab6e5bea589a22fc80d095594e2
-
SHA1
24b779dfb94c6d6687753c8d07ecbdf8e297c848
-
SHA256
50c0fe37a73271624a9aebfc93fd445a156b760c363d04edef4ff28e2b11a13f
-
SHA512
ed755492bd4216f359f7da3490a304ff4fb0e8b7bc30d661d9c6ebf8a7936c2f15dafc473faa3508f7c030ebb45ffe2b92e1343d595df2993577a1c10c28d40f
-
SSDEEP
1536:yNlfjeFrVQjBAuzFnToIfreQG654B+D5chcFFV7D+:y7BBAuztTBfref1Vmo
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 48c4dab6e5bea589a22fc80d095594e2
Files
-
48c4dab6e5bea589a22fc80d095594e2.dll windows:4 windows x86 arch:x86
db8fd4c77eb5e697be3954c5675e04d0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetEnvironmentVariableA
GetShortPathNameA
GetModuleFileNameA
FreeLibrary
GetProcAddress
LoadLibraryA
Process32Next
Module32First
Process32First
CreateToolhelp32Snapshot
TerminateProcess
OpenProcess
WaitForSingleObject
CreateThread
MoveFileExA
lstrcpyA
MoveFileA
CopyFileA
DeleteFileA
GetFileSize
CreateFileA
WriteFile
GlobalMemoryStatus
GetVersionExA
GetComputerNameA
GetTickCount
HeapAlloc
GetProcessHeap
GetCurrentProcessId
GetCurrentThreadId
lstrcatA
GetCurrentProcess
SetPriorityClass
GetCurrentThread
SetThreadPriority
ResumeThread
FindFirstFileA
FileTimeToLocalFileTime
FileTimeToSystemTime
GetLastError
FindNextFileA
FindClose
GetDriveTypeA
CreatePipe
GetStartupInfoA
GetSystemDirectoryA
CreateProcessA
CloseHandle
Sleep
GetWindowsDirectoryA
ReadFile
user32
CloseWindowStation
CloseDesktop
GetThreadDesktop
OpenWindowStationA
SetProcessWindowStation
OpenDesktopA
SetThreadDesktop
GetSystemMetrics
wsprintfA
ExitWindowsEx
GetProcessWindowStation
gdi32
DeleteObject
DeleteDC
GetDIBits
BitBlt
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCA
advapi32
OpenServiceA
ChangeServiceConfigA
QueryServiceStatus
ControlService
CloseServiceHandle
SetServiceStatus
RegisterServiceCtrlHandlerA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenSCManagerA
shell32
ShellExecuteA
SHGetFileInfoA
msvcrt
__CxxFrameHandler
_ftol
_strlwr
rand
malloc
__dllonexit
_onexit
free
_initterm
_adjust_fdiv
??2@YAPAXI@Z
??3@YAXPAX@Z
strstr
strcspn
sprintf
strncpy
atoi
ws2_32
send
inet_addr
shutdown
recv
closesocket
connect
socket
htons
WSAStartup
setsockopt
sendto
htonl
WSASocketA
gethostbyname
Exports
Exports
Sections
.text Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ