Behavioral task
behavioral1
Sample
7cca481721c5ff1989b055fa013e0455.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7cca481721c5ff1989b055fa013e0455.exe
Resource
win10v2004-20231215-en
General
-
Target
7cca481721c5ff1989b055fa013e0455
-
Size
956KB
-
MD5
7cca481721c5ff1989b055fa013e0455
-
SHA1
6ff9851cf48ceb417d8e8f9241509f97bf47c91b
-
SHA256
afa711dcdaecdefb5348b92193a0a00d239e520e650732e2a4a5babb7df26841
-
SHA512
d622d762c804571b3f2679644533254fe72db7ac74f4f9554b69651a9d175581c3a5f331cf0e82a0c1f59413e396e4757289b91f4dfb667be1becbbce95e40f3
-
SSDEEP
24576:O9U2qNqy51Yh2/g2okBxZsZpr3qUp1S3yzWzfSjUU7Z:3ZM2VuNP1CQwQUUd
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7cca481721c5ff1989b055fa013e0455
Files
-
7cca481721c5ff1989b055fa013e0455.exe windows:4 windows x86 arch:x86
995c88bf8621480f98d4e36797e56bc1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvfw32
DrawDibDraw
avifil32
AVIStreamInfoA
winmm
waveOutReset
ws2_32
select
rasapi32
RasGetConnectStatusA
kernel32
SetEndOfFile
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
PtInRect
MessageBoxA
gdi32
Polygon
msimg32
TransparentBlt
winspool.drv
DocumentPropertiesA
comdlg32
GetFileTitleA
advapi32
RegQueryValueA
shell32
Shell_NotifyIconA
ole32
OleInitialize
oleaut32
LoadTypeLi
comctl32
ImageList_Draw
wininet
HttpSendRequestA
Sections
CODE Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: - Virtual size: 866KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 203KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 550KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 423KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp1 Size: 920KB - Virtual size: 919KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE