Behavioral task
behavioral1
Sample
bae4ff610457a32c7f2898e79c999c7c.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
bae4ff610457a32c7f2898e79c999c7c.exe
Resource
win10v2004-20240226-en
General
-
Target
bae4ff610457a32c7f2898e79c999c7c
-
Size
1.2MB
-
MD5
bae4ff610457a32c7f2898e79c999c7c
-
SHA1
725b5bfcd4a6a219fef93aecc8dcf4ea20bc47f1
-
SHA256
bac03f47413805251eb95bb8c224e1aa50cedf75389f6d8ea52957168cf96dd4
-
SHA512
6742d6ce63a541534ca58921dbadd7e6ddfa9eaa29d64d9828f0a60373c7fb3395ef6b9bc16c97924ca4b468da344862d4cd9cc6c9915c86466a2cc5218b1b46
-
SSDEEP
24576:RqyaDV4r7UggnDD0nwZcUzDA1/OEcG1VEQ75DOKqBcPnpEbtg7g7/QpT:RqyM43HYP00cUzDAJOEy46tOPWbJ7k
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bae4ff610457a32c7f2898e79c999c7c
Files
-
bae4ff610457a32c7f2898e79c999c7c.exe windows:4 windows x86 arch:x86
88ef0218f3635c7c0f4924e3a1622d92
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvfw32
DrawDibDraw
avifil32
AVIStreamGetFrame
iphlpapi
GetAdaptersInfo
winmm
waveOutGetNumDevs
ws2_32
getpeername
kernel32
SetEvent
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CallNextHookEx
MessageBoxA
gdi32
CreateRoundRectRgn
winspool.drv
OpenPrinterA
comdlg32
GetFileTitleA
advapi32
RegCreateKeyExA
shell32
ShellExecuteA
ole32
CoCreateInstance
oleaut32
RegisterTypeLi
comctl32
ord17
Sections
.text Size: - Virtual size: 707KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 115KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 302KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 718KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 1.2MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE