C:\Users\69FAV\Documents\LS\host.pdb
Behavioral task
behavioral1
Sample
73b144da49b692feb6923e6d0a211d07163031b200a7deb6678a0c44ada6d838.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
73b144da49b692feb6923e6d0a211d07163031b200a7deb6678a0c44ada6d838.exe
Resource
win10v2004-20231215-en
General
-
Target
73b144da49b692feb6923e6d0a211d07163031b200a7deb6678a0c44ada6d838.exe
-
Size
781KB
-
MD5
c1d0ca54d9522166875cfebb8aeaddba
-
SHA1
1da1721c9f85724e060fc2c446e94da865a8b7ea
-
SHA256
73b144da49b692feb6923e6d0a211d07163031b200a7deb6678a0c44ada6d838
-
SHA512
c788a48f5782027152e57fbc4a43c900a97373a2eecf09e689ec6287ee15817cc0b176fd57f339085c9ec5632aa5d1b1289467dc9af5542ad93639a3f301e48c
-
SSDEEP
24576:5h02f51jCveePaEUOguT/7Y/AsNkJh19L:42/JePaQ/T/7xs2L19
Malware Config
Signatures
-
Detects executables packed with VMProtect. 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_VMProtect -
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 73b144da49b692feb6923e6d0a211d07163031b200a7deb6678a0c44ada6d838.exe
Files
-
73b144da49b692feb6923e6d0a211d07163031b200a7deb6678a0c44ada6d838.exe.exe windows:5 windows x86 arch:x86
8ccad98be214157463c7dfa879130c6a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
HeapSize
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
ShowWindow
advapi32
RegSetValueExW
msvcp100
??1_Lockit@std@@QAE@XZ
msvcr100
fclose
wininet
InternetReadFile
Exports
Exports
EndScaneRender
l}���Dvj�\ �L���F"��J��x�*��ll���Wk������:�b4��^�zU�Y�U�41*���e4a��ծ�z�Iˇ6�P���aQ^�D�K�&�a_�n/\�oV@6���:iM�4:�7P��u�����u��iI��*D;�G��s�I�L��F����,�F���7{ o�ԫ��H?P������.mr,��B���3'�b�p �����Vs�(��y!f{���E�ABsq�F$��D �}"������Њ6��G��O�,�#X�F�4Д�x5�:����.������ �fz��̣"�\��Վ(m��w��}4�Q$Qk۴��=p(���wv�E����������;�6o*��O<�Q'$!��&R��h�۳Ix�?l��/ ߂��&���Ӎ6���M�X�r�ٖ�y�_� S�I �mҊE���J�v�>O�.b9b�B�,�~�9rj����G����"�����T��b̍<<?r|�~f���@����\ow�-S�oJ���3�~���~ e����'T~�Q��]������"?��Nj�)�~N �� ,��*��㫒9�"E �>�3b3��T�O$3���g[��e�@����Z<�!�fH&�Ĕ��p�����ᙹQ�o7���2�E,��V���+�5�w����/:Pma�:�^cmx��h�^q�ȧ˚ #�����G%x:�g3�8>���%��eK�N�Z��W�@ǗYd$�\�@Hi��k���kB�P~7�U�BB��\&ۗZ�y�iz�\�S�d����Zx�$���,3͠�?M���W�Nt=#���V&�Ҳ�P.�A�D��1�օ���¤�OO���9�&!�;�S������@�%I�2�?+��6_���UB�ݲ�(HB���g���v�ƻ�1�k�J/J��L��4����qr�fa�����p��bDc8������;-O<m��Ր�}�wC��J#�(�ƈ7���cC�N�8�����F�G�n9��lW�����} ��=1}C����q��5p}%�P>|_g�����Oq�J�"�7���iw�gT���^�aKC������t��>1gC�J<k�4?��d�&i}.i��,Uj��[��q�)�taZM�iN#D����}H��p�����x�����qbojF<��4�7v٦����r:W��y<f�haE����y[f�������e 0��#`��������1y�z��9��[O�9�q �py����F��Yo�w ����@A:pP%�K��c,��H[(�<�ጐ�*h=���:��cҀ7��v��`R���3���KI p[��"ai����4:�哓��D��X��H�,�N��^��l�I��^x\�jhY3ԁ��=��ib��}ɪ����pЭ�[.O:^ v 'J�<�Y���dD�\1�s|�z��V�W��� �hZ\���c�^�y����5������|T�=������3�=�J��pe���d����<����@Ţ��'4��Mn�h��]���\Kn��֑�C!�p�`;C(�f��ƟV¦s)O{�=4�s��O���U���)&ٵ��l��n�/#)��q{�0T�Q ���O?�G���{"�[g|;T���6��D���Cٍ������M���/��3'�'��7`�ߨ\��^�{�O�����)�3f �"K?�C�r]��4��%��*bV:�`�q��ҵ�3����� �GL>ʞ���1L'bӏI��E[C����b��08�. ���~;��K�����!7��i��*�����Q���R�ۇ��]�H5���X���WN/C�.UMH���{���j��!��ۣYn�*�U�?��ti��,�r��,� �+�cۋm�Wt����NMD}����dn�0@�-9 �H�b�0�C6��3\��8C�K�9D~n<v��\A/�B ���i�@����b����:� ,�ς[J��a��V��_?�|������v�s�c�8}�j.��D�z�K�燌��@bv�!�����AXΣ�jB_z{�*ZlN��%щ���{6a��>Q��F_卄��|��1�E'����!|������~��kN,�F�u���d��A���r^̖cAD���< �� IC����e�Nɕ\�{'u�e����6�*pa���P�DQ����B�8'��j;���beL�ި���>1�Y)N1��0^(��3��� ��2��0TW��㞇��v�>)�c�\(�_S#4F�j�N���7OB���ѱ�A��5�=X=4I4���㲁�0u���VÝu�3��H���$�wt�Z,���6)�"MS����~��%��ܚ��:��W���u&-@ӂ'�)�ʥ�i8�!�j&S %���sf52�-��� /�匹�7�l+����KP�Vz_�zd9`VUi��[HE�F"�mq��K�[uN_����qp�$&ՏF�/����A����Faw !����1��L(3�u�:�� ̥�Y^�A�BnG'�xc*��D��S�B<�X�h�������Y���U�����s��C?Rή���_غ���m���*M(V3�ӱ��o��L V�����)�W&0���rmTo�6o����,�U�>U`6��x!�*}w7��\�2���vH~�Q��%��`�Y�*����[��������Z.Q^��v �X�����W��0q�j��<%p���㯭�J��Ý�:v���}�0�bvl��W<G?����86q����u(��0������3������:�1�ԧ}/l�ɹ4�$u�r �7D�#NQ���G�h�d�E��f�"q��I�����8���E��`E��;�̘��F���Ŵ�3X�*u�Ǖ������C�-��a��]L;(��DujJ�<E���+؋W�b�n����}�a��A�|�)_c���)��g\��A �fX�{���*��ż�-�Y1&h�9Ss���xxld4���4������������ �S#g�P������S��L;���G�4;���Q���̛�R����^��$\˅Mn���5er��ҕIe�g��6ͮD��33W�5�v}�I�t
Sections
.text Size: - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 678KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 779KB - Virtual size: 778KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 232B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 434B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ