Behavioral task
behavioral1
Sample
9022259b42795bad16a7c6c088a8cb75.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
9022259b42795bad16a7c6c088a8cb75.exe
Resource
win10v2004-20231215-en
General
-
Target
9022259b42795bad16a7c6c088a8cb75
-
Size
1.1MB
-
MD5
9022259b42795bad16a7c6c088a8cb75
-
SHA1
bad43a64766e98a2c481ea83405c3583aef7ff28
-
SHA256
7fb17951a05461eb81b25312c6239156ed5677095c6d3fb047a37b51cd31988c
-
SHA512
b49f7fb6e2081dcfd6b74d4cdd4b890f881116430615f0fc1b36561560583bb4777e978fbf8a011480e3f4a030b4a228720afccb976c21482c15f77a6135ef93
-
SSDEEP
24576:stq/HQHZ5PTnDwIlcr8/0106xNnMw4jMIwREx9vdLZj1fJGgpaxnkvOwThwN3:stq4HPYIlO8/0106NnF6MHR6XLZJ9AxR
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9022259b42795bad16a7c6c088a8cb75
Files
-
9022259b42795bad16a7c6c088a8cb75.exe windows:4 windows x86 arch:x86
2829c21ad8da539f8fb194b324eb6082
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapFree
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetScrollRange
gdi32
CreateRectRgnIndirect
winmm
waveOutWrite
winspool.drv
OpenPrinterA
advapi32
RegQueryValueA
shell32
ShellExecuteA
ole32
CoFreeUnusedLibraries
oleaut32
SafeArrayCreate
comctl32
ord17
oledlg
ord8
ws2_32
WSAAsyncSelect
comdlg32
GetFileTitleA
Sections
.text Size: - Virtual size: 547KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 210KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 325KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp1 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE