Behavioral task
behavioral1
Sample
mGuC4XAcg4.exe
Resource
win7-20231215-en
General
-
Target
mGuC4XAcg4.exe
-
Size
6.0MB
-
MD5
3792c154dacb91db56232051a5f3429d
-
SHA1
d6fea7e10b7baefdb0524445a8a8795bca72f510
-
SHA256
7a293232e80bae7f564139b6e8c306f1f68503bce0a260a1cfff203ff599390c
-
SHA512
2c1aec2720c6a2b0fda7bc71b45938c221f5a048e0d696f093d27f5ac9b68e9194d074492921e856286f1b8d3a068eed2e872a74feb7953bacedb7b7a4999aeb
-
SSDEEP
98304:BEyOYaUS6mmNy3VmoQw4tc8R/LGWUPrfbEFbaGvIJNWPXW3VJSV:GTLRtfTQc8sW0fbEFG6XW3VJSV
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource mGuC4XAcg4.exe
Files
-
mGuC4XAcg4.exe.exe windows:6 windows x64 arch:x64
cf4c1fd4712d13148927ff4e7b0e8ae2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
VirtualFreeEx
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MonitorFromPoint
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
DeleteDC
advapi32
RegQueryValueExA
shell32
SHGetFolderPathW
oleaut32
VariantClear
msvcp140
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
imm32
ImmSetCompositionWindow
d3dcompiler_47
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
d3d11
D3D11CreateDeviceAndSwapChain
wininet
InternetConnectW
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
api-ms-win-crt-stdio-l1-1-0
fclose
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-math-l1-1-0
_dsign
api-ms-win-crt-filesystem-l1-1-0
remove
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-environment-l1-1-0
getenv
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 415KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 86KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.0MB - Virtual size: 6.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 220B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ