Behavioral task
behavioral1
Sample
96262d61166d88fb0633ae612dabe1db.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
96262d61166d88fb0633ae612dabe1db.dll
Resource
win10v2004-20231215-en
General
-
Target
96262d61166d88fb0633ae612dabe1db
-
Size
104KB
-
MD5
96262d61166d88fb0633ae612dabe1db
-
SHA1
4b287693d96f0df3feab6c10a2bcb86574c19da9
-
SHA256
2a0e9b131f7ab5a9f05b67a5136b437a8482ab7a8886b6cacb6063d79c10e230
-
SHA512
dee455860ec42d386b5532db3a9f1702b2b0c355134220c1879ee04f294e3f0442d6b8ca8ff8d08b97d5d416d20d7c3763431d0dac6785806c3780c6d8525f58
-
SSDEEP
1536:x4mlTueoPxoxTRMfWJCjqGSWuoNPMWBUfko1wvarrTr9jlX9MQafpaoR/s1ATMP:rTueoPkKMCWGf1U9bjrT1akoR/O2A
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 96262d61166d88fb0633ae612dabe1db
Files
-
96262d61166d88fb0633ae612dabe1db.dll windows:4 windows x86 arch:x86
5142e43e891de6150822f986d99bb9f0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mfc42
ord6663
ord858
ord535
ord540
ord922
ord924
ord926
ord537
ord5710
ord4129
ord2915
ord941
ord1168
ord536
ord3178
ord4058
ord2781
ord668
ord610
ord2770
ord6139
ord287
ord356
ord823
ord860
ord4278
ord800
ord2818
ord939
ord6877
ord825
msvcrt
printf
atoi
rand
srand
time
__CxxFrameHandler
_mbscmp
free
malloc
fclose
fread
_adjust_fdiv
_initterm
exit
strtok
sprintf
fwrite
fopen
_stat
kernel32
CreateThread
GlobalUnlock
CreateMutexA
GetLastError
ExitProcess
GetSystemDirectoryA
GetCurrentProcess
GetSystemInfo
GetDiskFreeSpaceExA
GlobalSize
GlobalLock
CreateProcessA
LoadLibraryA
GetProcAddress
GetComputerNameA
GetVersionExA
lstrcpyA
GlobalMemoryStatus
GetDriveTypeA
GetProcessHeap
HeapAlloc
GetTickCount
GetCurrentProcessId
DeleteFileA
Sleep
GlobalFree
GlobalReAlloc
GlobalAlloc
CloseHandle
TerminateThread
ExitThread
user32
IsRectEmpty
ReleaseDC
MessageBoxA
wsprintfA
ExitWindowsEx
GetSystemMetrics
GetDC
gdi32
DeleteObject
GetStockObject
GetObjectA
SelectPalette
RealizePalette
GetDIBits
CreateDCA
CreateCompatibleDC
GetDeviceCaps
CreateCompatibleBitmap
SelectObject
BitBlt
DeleteDC
advapi32
RegCloseKey
OpenSCManagerA
OpenServiceA
ControlService
RegOpenKeyA
RegDeleteValueA
RegSetValueExA
StartServiceA
CloseServiceHandle
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
RegQueryValueExA
shell32
ShellExecuteA
ws2_32
gethostbyname
closesocket
connect
htons
inet_addr
socket
sendto
setsockopt
WSASocketA
WSAStartup
gethostname
inet_ntoa
htonl
send
WSAGetLastError
recv
__WSAFDIsSet
select
Sections
.text Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 243KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 864B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 52KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ