Behavioral task
behavioral1
Sample
9d5c32d4b0082db1043cc3757b8603c7168115c1b4642c8413e585ef5c249b9d.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
9d5c32d4b0082db1043cc3757b8603c7168115c1b4642c8413e585ef5c249b9d.exe
Resource
win10v2004-20231222-en
General
-
Target
9d5c32d4b0082db1043cc3757b8603c7168115c1b4642c8413e585ef5c249b9d
-
Size
395KB
-
MD5
e1c43ed5514a403e9c08a683b27f82e3
-
SHA1
634602119b4cce1eef03183aa764212914fcc1e8
-
SHA256
9d5c32d4b0082db1043cc3757b8603c7168115c1b4642c8413e585ef5c249b9d
-
SHA512
49a28b6f31b07101ff1f670c482d4a013d27cad02f2e374184ca8f5e94e3d1bb79f9f9f7a0588a3cb88a39958e887d750ecb28010c04e35690af866addafd384
-
SSDEEP
12288:BoAGirgHEePhLlLvK8f8NknTG0t652/xEZ:BuHbLluw5WBZ
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9d5c32d4b0082db1043cc3757b8603c7168115c1b4642c8413e585ef5c249b9d
Files
-
9d5c32d4b0082db1043cc3757b8603c7168115c1b4642c8413e585ef5c249b9d.exe windows:5 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 498KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.2MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ