ServiceMain
Behavioral task
behavioral1
Sample
727caee9c6ec073e7ee80797b24c5e58.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
727caee9c6ec073e7ee80797b24c5e58.dll
Resource
win10v2004-20231215-en
General
-
Target
727caee9c6ec073e7ee80797b24c5e58
-
Size
82KB
-
MD5
727caee9c6ec073e7ee80797b24c5e58
-
SHA1
8a426e07edb307cd27ee7cf422f82f33fc6e5f00
-
SHA256
dbe37e52c1300f1ff21ff8b9fc65358af0f136a077cf8c1e5322d00df90ffb8b
-
SHA512
f0a4ea223ad75a34502590098095bac5a1c1ceba0312f072e0f917f31b2810e58a74710aef3a3ee42359b220eed2806049a97f09e5db73352135814e1412cffc
-
SSDEEP
1536:kN0KCEeNFa4oZBAe0FnToIf+AwH92cbUfKBVjbkH+STD:kmKCEZBAe0tTBf+AwMcbX/jbkH7T
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 727caee9c6ec073e7ee80797b24c5e58
Files
-
727caee9c6ec073e7ee80797b24c5e58.dll windows:4 windows x86 arch:x86
db8fd4c77eb5e697be3954c5675e04d0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetEnvironmentVariableA
GetShortPathNameA
GetModuleFileNameA
FreeLibrary
GetProcAddress
LoadLibraryA
Process32Next
Module32First
Process32First
CreateToolhelp32Snapshot
TerminateProcess
OpenProcess
WaitForSingleObject
CreateThread
MoveFileExA
lstrcpyA
MoveFileA
CopyFileA
DeleteFileA
GetFileSize
CreateFileA
WriteFile
GlobalMemoryStatus
GetVersionExA
GetComputerNameA
GetTickCount
HeapAlloc
GetProcessHeap
GetCurrentProcessId
GetCurrentThreadId
lstrcatA
GetCurrentProcess
SetPriorityClass
GetCurrentThread
SetThreadPriority
ResumeThread
FindFirstFileA
FileTimeToLocalFileTime
FileTimeToSystemTime
GetLastError
FindNextFileA
FindClose
GetDriveTypeA
CreatePipe
GetStartupInfoA
GetSystemDirectoryA
CreateProcessA
CloseHandle
Sleep
GetWindowsDirectoryA
ReadFile
user32
CloseWindowStation
CloseDesktop
GetThreadDesktop
OpenWindowStationA
SetProcessWindowStation
OpenDesktopA
SetThreadDesktop
GetSystemMetrics
wsprintfA
ExitWindowsEx
GetProcessWindowStation
gdi32
DeleteObject
DeleteDC
GetDIBits
BitBlt
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCA
advapi32
OpenServiceA
ChangeServiceConfigA
QueryServiceStatus
ControlService
CloseServiceHandle
SetServiceStatus
RegisterServiceCtrlHandlerA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenSCManagerA
shell32
ShellExecuteA
SHGetFileInfoA
msvcrt
__CxxFrameHandler
_ftol
_strlwr
rand
malloc
__dllonexit
_onexit
free
_initterm
_adjust_fdiv
??2@YAPAXI@Z
??3@YAXPAX@Z
strstr
strcspn
sprintf
strncpy
atoi
ws2_32
send
inet_addr
shutdown
recv
closesocket
connect
socket
htons
WSAStartup
setsockopt
sendto
htonl
WSASocketA
gethostbyname
Exports
Exports
Sections
.text Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ