Behavioral task
behavioral1
Sample
326c2126b935912b9cafab58e39590b3f105360f95da860958b00db09d340af0.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
326c2126b935912b9cafab58e39590b3f105360f95da860958b00db09d340af0.exe
Resource
win10v2004-20240226-en
General
-
Target
326c2126b935912b9cafab58e39590b3f105360f95da860958b00db09d340af0
-
Size
961KB
-
MD5
6d16c5869a88edb01643258d2f2d6156
-
SHA1
9e63ac1e51e1022a6f691577b10a505a3de44c68
-
SHA256
326c2126b935912b9cafab58e39590b3f105360f95da860958b00db09d340af0
-
SHA512
6596b7ec757b772700eea052a37156eb51fd65bb823e867719932b6437abb9a14d1f10e5b2295ac2e640bc76aac440451d4abbaa2458f61788215d99f60f9eee
-
SSDEEP
24576:hbJjY9OPRn9PTX8J9Qnnr7qM65my4zPwpnuJoEA/l:hp9ArOrOV5ozPon7
Malware Config
Signatures
-
Detects executables packed with VMProtect. 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_VMProtect -
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 326c2126b935912b9cafab58e39590b3f105360f95da860958b00db09d340af0
Files
-
326c2126b935912b9cafab58e39590b3f105360f95da860958b00db09d340af0.exe windows:5 windows x86 arch:x86
1259b62f6b5004eadc455d0c4dfe0df2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetACP
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
DispatchMessageW
gdi32
SelectObject
advapi32
RegOpenKeyExW
shell32
SHGetFolderPathW
ole32
GetHGlobalFromStream
ws2_32
WSAEnumNetworkEvents
winmm
timeGetTime
gdiplus
GdipFree
Sections
.text Size: - Virtual size: 88KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 185KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 742KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 959KB - Virtual size: 959KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 144B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 434B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ