Behavioral task
behavioral1
Sample
9a7a27a1d628f97f91d8672de75ea63b0207d61989b4958aa7c662b6b05244e0.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9a7a27a1d628f97f91d8672de75ea63b0207d61989b4958aa7c662b6b05244e0.exe
Resource
win10v2004-20240226-en
General
-
Target
9a7a27a1d628f97f91d8672de75ea63b0207d61989b4958aa7c662b6b05244e0
-
Size
13.5MB
-
MD5
03f7c2ce418268c1d330e1d181e2e5db
-
SHA1
b4c29c383f4fe3c73cfe597d03aa3bbb04d63be9
-
SHA256
9a7a27a1d628f97f91d8672de75ea63b0207d61989b4958aa7c662b6b05244e0
-
SHA512
1b2a4221e3d71be87b69b2de777ccdaf778fecb7cb864b2abd68b3feb1252509701e6815d692371bb1948e99a2f2f952d211867b4f6131582f9da79a58b792b0
-
SSDEEP
393216:ydyjy1KwYY2EcP0SDACiHJSg9PavwP+F/k2iC:K1xgPXQ5PaYP+ZziC
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9a7a27a1d628f97f91d8672de75ea63b0207d61989b4958aa7c662b6b05244e0
Files
-
9a7a27a1d628f97f91d8672de75ea63b0207d61989b4958aa7c662b6b05244e0.exe windows:5 windows x86 arch:x86
b83faf04584e4ae9e6ebd8b8668b62bb
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
iphlpapi
GetAdaptersInfo
winmm
waveOutWrite
ws2_32
send
rasapi32
RasGetConnectStatusA
kernel32
GetVersionExA
GetVersion
SetEvent
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
FindWindowA
gdi32
Escape
winspool.drv
ClosePrinter
advapi32
RegSetValueExA
shell32
SHGetSpecialFolderPathA
ole32
OleInitialize
oleaut32
SafeArrayGetUBound
comctl32
ord17
wininet
HttpOpenRequestA
comdlg32
ChooseColorA
Sections
.text Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 14.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 403KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 9.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 13.4MB - Virtual size: 13.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ