Behavioral task
behavioral1
Sample
bc464cf6cff2ed4f02bb55694f69b198.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
bc464cf6cff2ed4f02bb55694f69b198.exe
Resource
win10v2004-20240226-en
General
-
Target
bc464cf6cff2ed4f02bb55694f69b198
-
Size
1.0MB
-
MD5
bc464cf6cff2ed4f02bb55694f69b198
-
SHA1
1b92221c025354f9020e5298299b370ba75424be
-
SHA256
a97f4c64e0493086b5e3b413b79f9ee887a184e1989c8b6928c3021b51dfb42f
-
SHA512
ce95a31240887c6f4246b613b25e38eccd774eaf993766922829ea20fce4aeda248a0aa1a5e6e5ee3f43326c27e99df7e3cb26ad4e484a1d31601614a2c6a372
-
SSDEEP
24576:CcY8QHGHt+SeOF3B9igjEu4ywKvmxSEMp1W3BXUeAaASYjPiNHnf:kHO+E9igjERKvuSEN3BXUZadyUH
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bc464cf6cff2ed4f02bb55694f69b198
Files
-
bc464cf6cff2ed4f02bb55694f69b198.exe windows:4 windows x86 arch:x86
0f80f69596b90c90b51a80984c3d93b7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvfw32
DrawDibDraw
avifil32
AVIStreamGetFrame
winmm
midiStreamProperty
ws2_32
WSAAsyncSelect
rasapi32
RasHangUpA
kernel32
FindFirstFileA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
RemovePropA
MessageBoxA
gdi32
StretchBlt
msimg32
TransparentBlt
winspool.drv
ClosePrinter
comdlg32
GetOpenFileNameA
advapi32
RegQueryValueA
shell32
ShellExecuteA
ole32
CoInitialize
oleaut32
LoadTypeLi
comctl32
ImageList_Draw
wininet
InternetConnectA
Sections
CODE Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 205KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 503KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 439KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp1 Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE