Behavioral task
behavioral1
Sample
320c1281a45a13b21f29f91ea3ba3827975220bd39a1999d9a8f475145172e67.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
320c1281a45a13b21f29f91ea3ba3827975220bd39a1999d9a8f475145172e67.exe
Resource
win10v2004-20240226-en
General
-
Target
320c1281a45a13b21f29f91ea3ba3827975220bd39a1999d9a8f475145172e67
-
Size
10.3MB
-
MD5
d1325d07a65630f78b9849643344d1cd
-
SHA1
3ad231060cfe6494a8884eec5950de56269c7c04
-
SHA256
320c1281a45a13b21f29f91ea3ba3827975220bd39a1999d9a8f475145172e67
-
SHA512
a0baa9bea87c3c79f4ea9b092daa10b9879ebf7079b5b612c2dd08e0607632a6646f9966e9f896baa4385d7f9f1a5ac1555bbca8d54f17691c07a5c1327d3fbb
-
SSDEEP
196608:CJjWxkn9dTqIRu5Q7NVvDqF0Sbe/B1aAmTxWqFpysW4rC1UI5Hlu/TtGSb:+WxO25QhkOSbefaA8rj/e1UI5Y/hb
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 320c1281a45a13b21f29f91ea3ba3827975220bd39a1999d9a8f475145172e67
Files
-
320c1281a45a13b21f29f91ea3ba3827975220bd39a1999d9a8f475145172e67.exe windows:5 windows x86 arch:x86
b96f911793aa2a8a7e7747b42b8bc3c7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegOpenKeyExA
comctl32
_TrackMouseEvent
gdi32
GetObjectA
imm32
ImmSimulateHotKey
kernel32
GetVersionExA
GetVersion
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
msimg32
AlphaBlend
msvcp100
??1_Container_base12@std@@QAE@XZ
msvcr100
atol
oleaut32
OleLoadPicture
psapi
GetProcessImageFileNameA
ribbonbar
?ReLoadUserCfg@@YAXJ@Z
shell32
SHGetFileInfoA
tbeauty
TBeauty_CreateTdxTab
tcalc
?GetTypeNum@CMainCalcInterface@@QAEJXZ
tcontrol
??1CMarkup@@QAE@XZ
tgear
RejustDateCtrlRange
tjyaid
GetWtDefInfoFromETradeXML_More
tmarquee
NewMarquee
tqqcalc
TQQCalc_Yhbdl
tdxasiocomm
?MakeUserCommModule@@YAPAVVUserComm@@XZ
user32
TabbedTextOutA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
viewthem
?INFO_ReqGGCjzx@@YAHFFPADFF@Z
winmm
PlaySoundA
ws2_32
getaddrinfo
WSAGetLastError
gdiplus
GdipAlloc
invest
?SetPrivateInvestDir@@YAXPAD@Z
mfc100
ord3582
ole32
CoInitialize
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 856KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 10.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.SCY Size: - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.net Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: - Virtual size: 4.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 9.5MB - Virtual size: 9.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 755KB - Virtual size: 755KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ