Behavioral task
behavioral1
Sample
c5f9e8a96f71ab6704fcf716c2ca8a8d973a753b9a4bd01381ebf83ae476974f.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
c5f9e8a96f71ab6704fcf716c2ca8a8d973a753b9a4bd01381ebf83ae476974f.exe
Resource
win10v2004-20231215-en
General
-
Target
c5f9e8a96f71ab6704fcf716c2ca8a8d973a753b9a4bd01381ebf83ae476974f
-
Size
548KB
-
MD5
890c203da9d69e62fb754788cb4aa653
-
SHA1
8e6d27ffe96784f7a94bfa766f8ab104affb3299
-
SHA256
c5f9e8a96f71ab6704fcf716c2ca8a8d973a753b9a4bd01381ebf83ae476974f
-
SHA512
784bb36b9a17e7eb3a8b668619a18206b3238b6b4b1ab97410ea7759fde0a38acaad8a8f12bf90ab87d2380a20b8d052d7d65f45017dbd1ecc0b16f8d3be0aeb
-
SSDEEP
12288:BoAGirgHEePhLlLvK8f8NknTG0t652/xEpq5bR9gh1sDNF:BuHbLluw5WBpqdRC6D
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c5f9e8a96f71ab6704fcf716c2ca8a8d973a753b9a4bd01381ebf83ae476974f
Files
-
c5f9e8a96f71ab6704fcf716c2ca8a8d973a753b9a4bd01381ebf83ae476974f.exe windows:5 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 498KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.2MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ