Behavioral task
behavioral1
Sample
bf27fd3e403a30fa2f3109e147e48ffd.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
bf27fd3e403a30fa2f3109e147e48ffd.dll
Resource
win10v2004-20240226-en
General
-
Target
bf27fd3e403a30fa2f3109e147e48ffd
-
Size
1.9MB
-
MD5
bf27fd3e403a30fa2f3109e147e48ffd
-
SHA1
c3834efd8df510a9458c9cb57afc36f3ceda5e61
-
SHA256
815b4151eae77c29923cd8c531ba0280df0f4ec922e2ea1ea0bd522574ad9453
-
SHA512
3224de04521a925b99654b9de11c9afbc4649e0f75d7cfb9eb6f26bc8f2c573be413d2b077726bb6a7d2f9caa550d9d416a03da79790eb33ff0d2d37010ff89b
-
SSDEEP
49152:PZGmiwXJsTsJwh7hfWp8I2rBJ2hLqBqZWxvn0tADFNf3np:BGmiwXJsAJwrOp8ZdJqLqBIW1nGuHf3p
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bf27fd3e403a30fa2f3109e147e48ffd
Files
-
bf27fd3e403a30fa2f3109e147e48ffd.dll windows:5 windows x86 arch:x86
931de494e907a508d0fa38a6e07216f8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
Sleep
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
shlwapi
PathRemoveFileSpecA
wtsapi32
WTSSendMessageW
user32
CharUpperBuffW
advapi32
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
Sections
.text Size: - Virtual size: 143KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 324B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 174B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ