Behavioral task
behavioral1
Sample
440e707f6260d2bbf1f7cfa15ceb3a50c09fb18369ab686876ea3ade239ab714.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
440e707f6260d2bbf1f7cfa15ceb3a50c09fb18369ab686876ea3ade239ab714.exe
Resource
win10v2004-20240226-en
General
-
Target
440e707f6260d2bbf1f7cfa15ceb3a50c09fb18369ab686876ea3ade239ab714
-
Size
9.9MB
-
MD5
2aa5cd9688ca829b5d39677c330ba145
-
SHA1
bed7e05b3420c97f59f6e1e26b7c436f69e23d42
-
SHA256
440e707f6260d2bbf1f7cfa15ceb3a50c09fb18369ab686876ea3ade239ab714
-
SHA512
33a7a4d6dced3b3a585439c654f3c0d79836d72fdcdf7b154ef7bdf82d510cdf2b50a0baf53fa99bc423335dfe9f5319a14a38ffa8c797f8c76bda10825803ad
-
SSDEEP
196608:7J9kAUl2xjhZTRXY/qx41fjdwqFv1HDYtboF3pcBUd22cdDso:FCAUM7ZTRXQ1LKUv1jYtboHcBUAXdP
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 440e707f6260d2bbf1f7cfa15ceb3a50c09fb18369ab686876ea3ade239ab714
Files
-
440e707f6260d2bbf1f7cfa15ceb3a50c09fb18369ab686876ea3ade239ab714.exe windows:6 windows x86 arch:x86
c13dc1dc8dccd8f36154446c46fc532b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetMenuItemInfoA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
CreateBitmapIndirect
msimg32
GradientFill
winspool.drv
DocumentPropertiesA
advapi32
GetFileSecurityA
shell32
CommandLineToArgvW
comctl32
_TrackMouseEvent
shlwapi
PathFindExtensionA
uxtheme
GetWindowTheme
ole32
OleGetIconOfClass
oleaut32
LoadTypeLi
oledlg
ord4
urlmon
URLDownloadToFileA
gdiplus
GdiplusShutdown
winmm
PlaySoundA
wininet
InternetErrorDlg
ws2_32
sendto
oleacc
AccessibleObjectFromWindow
imm32
ImmGetContext
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 8.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1021KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: - Virtual size: 777B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00cfg Size: - Virtual size: 265B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 6.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 9.8MB - Virtual size: 9.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ