Behavioral task
behavioral1
Sample
8c08b6ed88c58bab6e1c1e6e71d581c8.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
8c08b6ed88c58bab6e1c1e6e71d581c8.exe
Resource
win10v2004-20231215-en
General
-
Target
8c08b6ed88c58bab6e1c1e6e71d581c8
-
Size
1.1MB
-
MD5
8c08b6ed88c58bab6e1c1e6e71d581c8
-
SHA1
ca04eaa25d40a6987431048c9bc4795d6904e13a
-
SHA256
a7367ff401f9ef3652055511d551900f627f0776e9b3b968f516ec6da1a875dc
-
SHA512
c7c38ca3877ba0bb1cec4b5710792f146a95397a00c4c2c2f05bde1e4c5ae69f5ad5d13152e6003d5afc8c221ff20a5a0893d329ff5a0a5de6465c2ef8b51960
-
SSDEEP
24576:vLlyrmLcox0wx55efOPdwU6OhJtF4I59jxaaDsGZ:vQKLcm0Cec16Mn59j5
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8c08b6ed88c58bab6e1c1e6e71d581c8
Files
-
8c08b6ed88c58bab6e1c1e6e71d581c8.exe windows:4 windows x86 arch:x86
a9b588b528f9e7b4c6388292c4e31c42
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcmpiA
GetModuleHandleA
GetProcAddress
VirtualProtect
user32
SetClipboardData
MessageBoxA
gdi32
ExtCreateRegion
winmm
midiStreamRestart
winspool.drv
ClosePrinter
advapi32
RegCreateKeyExA
shell32
ShellExecuteA
ole32
CreateILockBytesOnHGlobal
oleaut32
SafeArrayCreate
comctl32
ImageList_Destroy
oledlg
ord8
ws2_32
recv
comdlg32
GetOpenFileNameA
Sections
.text Size: - Virtual size: 466KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 710KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 137KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 135KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 160B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ