Behavioral task
behavioral1
Sample
7a7900a2c35160a51963d1519f50cc9dab7d7adb3ba45a8e764fc52798a7c612.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7a7900a2c35160a51963d1519f50cc9dab7d7adb3ba45a8e764fc52798a7c612.exe
Resource
win10v2004-20240226-en
General
-
Target
7a7900a2c35160a51963d1519f50cc9dab7d7adb3ba45a8e764fc52798a7c612
-
Size
11.3MB
-
MD5
08100aa4efb68d8bacc77853e452fb94
-
SHA1
bfb074df7ba533ed770ce6a8aebbd6517c1556f6
-
SHA256
7a7900a2c35160a51963d1519f50cc9dab7d7adb3ba45a8e764fc52798a7c612
-
SHA512
45beba94325558b88a7e87d16f651caaf67933ae45e6d2c5e080f435c9411e96aa2d0ea9509421180610e3e6e1f3075b40a9bf2e533cb4a6514ccd5c8bed5071
-
SSDEEP
196608:dP29NyHH33T+8v8XBoVsW7AlKOlIPverK8gSOPMsDDyfHhhw1ZOFNVW:dP2ryn3jZv8TI2KCwvUK8M1DUHLwrK/W
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7a7900a2c35160a51963d1519f50cc9dab7d7adb3ba45a8e764fc52798a7c612
Files
-
7a7900a2c35160a51963d1519f50cc9dab7d7adb3ba45a8e764fc52798a7c612.exe windows:6 windows x86 arch:x86
340257a6022b4d1c58530599866455ea
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetUserDefaultUILanguage
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetAsyncKeyState
gdi32
SetRectRgn
msimg32
AlphaBlend
winspool.drv
ClosePrinter
advapi32
AdjustTokenPrivileges
shell32
SHGetSpecialFolderLocation
comctl32
InitCommonControlsEx
shlwapi
StrFormatKBSizeA
uxtheme
GetThemeSysColor
ole32
CoTaskMemFree
oleaut32
SysAllocString
oledlg
ord8
gdiplus
GdipDrawImageI
iphlpapi
GetAdaptersInfo
ws2_32
setsockopt
oleacc
AccessibleObjectFromWindow
imm32
ImmGetContext
winmm
PlaySoundA
Sections
.text Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 314KB - Virtual size: 314KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 9.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 10.9MB - Virtual size: 10.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 74KB - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 80KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ