Behavioral task
behavioral1
Sample
77d21006339b349ad3f5ce9d6f290c28.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
77d21006339b349ad3f5ce9d6f290c28.exe
Resource
win10v2004-20231215-en
General
-
Target
77d21006339b349ad3f5ce9d6f290c28
-
Size
484KB
-
MD5
77d21006339b349ad3f5ce9d6f290c28
-
SHA1
ed171b5b0fc997fce9845bdce54a12cb680dd123
-
SHA256
848e73c9cdb484ab707de73f251e086b95cee55f3b760d0731464113997e1a8e
-
SHA512
d6bdb3aee0ae7eeb7d08d7203a089df4dd932e54243d5372c239d78dbc24289ff93e1ad8075d566705e1ded756364a881c2addf95c62b65295018dfed814e171
-
SSDEEP
12288:rkWX8RM2UQ4RwJvt6Ycut6YrwReYgAXYaQFwbZbGbi:r1MK24ecut6Ymg5t0d
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 77d21006339b349ad3f5ce9d6f290c28
Files
-
77d21006339b349ad3f5ce9d6f290c28.exe windows:4 windows x86 arch:x86
ce472f9e68ef8e03ad4a9ee03c8581c3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasGetConnectStatusA
kernel32
SetLastError
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
DispatchMessageA
MessageBoxA
gdi32
CreateBitmap
wsock32
gethostbyname
wininet
InternetOpenUrlA
advapi32
LsaOpenPolicy
shell32
ShellExecuteA
ole32
CoRevokeClassObject
winmm
timeSetEvent
shlwapi
PathFileExistsA
atl
ord47
dbghelp
MakeSureDirectoryPathExists
gdiplus
GdipCreateBitmapFromStream
oledlg
ord8
oleaut32
LHashValOfNameSys
winspool.drv
OpenPrinterA
comctl32
ord17
Sections
.text Size: - Virtual size: 576KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 330KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 167KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 476KB - Virtual size: 475KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 184B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ