Behavioral task
behavioral1
Sample
666879b7f715cf67631bc699f6c5150a.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
666879b7f715cf67631bc699f6c5150a.exe
Resource
win10v2004-20231215-en
General
-
Target
666879b7f715cf67631bc699f6c5150a
-
Size
108KB
-
MD5
666879b7f715cf67631bc699f6c5150a
-
SHA1
dce090d1fe143611b7836c9c989d01084e29c8af
-
SHA256
817f7019bfac92410534072bcfab054b1913db0ef290cf8cdaa9ccdd48590e09
-
SHA512
d034079a4e7294fdbcd7dab8944103bbc12627a51fb7910d886aa0d6fc42185491b86763b89075da44ee0d6a84453249997d6ede0f07ddf80fc67bce9ab17bac
-
SSDEEP
3072:VOSvms3RVQiv/KJ8W8Y4v1736v8h7tTzBww8U:VOsDd9H1TOWtnz
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 666879b7f715cf67631bc699f6c5150a
Files
-
666879b7f715cf67631bc699f6c5150a.exe .ps1 windows:4 windows x86 arch:x86 polyglot
67f0b06d0cd8421b9bf64a27097b5934
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
InitializeCriticalSection
DeleteCriticalSection
GetComputerNameA
FreeConsole
CreateEventA
TerminateProcess
CreateProcessA
SetEvent
AllocConsole
GetStdHandle
GlobalAlloc
GlobalFree
FormatMessageA
LocalFree
SetConsoleCtrlHandler
Sleep
GetModuleFileNameA
GetVersionExA
GetProcessHeap
HeapAlloc
HeapFree
OpenProcess
WaitForSingleObject
LoadLibraryA
FreeLibrary
GetCurrentProcess
CloseHandle
GetLastError
GetModuleHandleA
LeaveCriticalSection
EnterCriticalSection
CreatePipe
DuplicateHandle
GenerateConsoleCtrlEvent
SetStdHandle
GetProcAddress
WriteFile
ReadFile
TerminateThread
MultiByteToWideChar
GetCurrentThreadId
VirtualProtect
user32
SendMessageA
GetWindowTextLengthA
DestroyWindow
CreateWindowExA
RegisterClassA
DefWindowProcA
advapi32
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceA
RegDeleteValueA
ControlService
QueryServiceStatus
DeleteService
RegCreateKeyA
RegSetValueExA
CreateServiceA
ChangeServiceConfig2A
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
OpenSCManagerA
OpenServiceA
CloseServiceHandle
StartServiceCtrlDispatcherA
GetUserNameA
LookupAccountNameA
IsValidSid
GetLengthSid
CopySid
DeregisterEventSource
ReportEventA
RegisterEventSourceA
RegDeleteKeyA
msvcrt
_initterm
exit
__p__commode
__p___initenv
__getmainargs
_except_handler3
_mbscmp
_controlfp
__dllonexit
_onexit
_XcptFilter
_exit
memmove
strncmp
strtok
strncpy
sscanf
_mbslen
malloc
free
_strnicmp
atoi
strchr
atol
fopen
fgets
fclose
strrchr
__CxxFrameHandler
_iob
setvbuf
_open_osfhandle
_fdopen
__set_app_type
__p__fmode
printf
_purecall
_strlwr
_stricmp
??3@YAXPAX@Z
__setusermatherr
_adjust_fdiv
??2@YAPAXI@Z
strstr
sprintf
_beginthreadex
realloc
time
localtime
_endthreadex
_vsnprintf
fwrite
rand
msvcp60
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
??Mstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??9std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ
?assign@?$char_traits@D@std@@SAXAADABD@Z
?_Xran@std@@YAXXZ
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
??9std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IPBDI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_Xlen@std@@YAXXZ
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
ws2_32
inet_ntoa
inet_addr
ntohs
closesocket
send
setsockopt
WSAGetLastError
__WSAFDIsSet
select
gethostbyname
htons
getsockname
ioctlsocket
connect
socket
listen
bind
htonl
accept
recv
recvfrom
sendto
WSAStartup
WSACleanup
Sections
.text Size: - Virtual size: 200KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 100KB - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 536B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.mmmym Size: 30B - Virtual size: 30B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ