Behavioral task
behavioral1
Sample
66461b30a3348042d467bbaec07985105c3c89502073633908930c7f02344438.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
66461b30a3348042d467bbaec07985105c3c89502073633908930c7f02344438.exe
Resource
win10v2004-20240226-en
General
-
Target
66461b30a3348042d467bbaec07985105c3c89502073633908930c7f02344438
-
Size
5.6MB
-
MD5
9f89e28b7c30ebd17249f8bfe547eefc
-
SHA1
557613483f2cf6b41c132eeaa17efbbcd5e436e0
-
SHA256
66461b30a3348042d467bbaec07985105c3c89502073633908930c7f02344438
-
SHA512
b63c88039538e6c3183aeb6ac63845307bfa2f130e54ef51ff92e82ff74139eff19c51831e1bf4e0db898a0db21b4569c46ca40ce5ba5ad78c50973e84fb22c3
-
SSDEEP
98304:4lUCoCc+6gcwD8fUHY+5NpXNEfhNXAeoAvOyha+bv3kZ8KcANiPHAS:4hcbgfMqYKJmhNQ16Oy/cZ8v6iPHA
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 66461b30a3348042d467bbaec07985105c3c89502073633908930c7f02344438
Files
-
66461b30a3348042d467bbaec07985105c3c89502073633908930c7f02344438.exe windows:6 windows x86 arch:x86
8dd541051877f07a12968ef9eab3196f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ddraw
DirectDrawCreate
dsound
ord1
winmm
mmioClose
dinput
DirectInputCreateA
wsock32
WSAGetLastError
kernel32
FindNextFileA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
PostMessageA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
StretchDIBits
advapi32
RegCloseKey
shell32
ShellExecuteA
ole32
CoInitialize
lua51
lua_remove
netapi32
Netbios
dbghelp
MiniDumpWriteDump
imm32
ImmDestroyContext
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 131KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 983.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ