Behavioral task
behavioral1
Sample
a2d78842c4c858205d405a92eaf3e1bb067eeb9a3864ba4166d74425f1ce8df0.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a2d78842c4c858205d405a92eaf3e1bb067eeb9a3864ba4166d74425f1ce8df0.exe
Resource
win10v2004-20240226-en
General
-
Target
a2d78842c4c858205d405a92eaf3e1bb067eeb9a3864ba4166d74425f1ce8df0
-
Size
5.6MB
-
MD5
8f68737b004e65f5cd3c589eafffe188
-
SHA1
893e8802a90673c61bbb4dc3640b5e9b31ef1cde
-
SHA256
a2d78842c4c858205d405a92eaf3e1bb067eeb9a3864ba4166d74425f1ce8df0
-
SHA512
34d1cfca1562feba9abfc4ffc68c27fdef4e0fd4a7505920efce395aba3a3d901abacfbdceff1cf4ee8fde221e54553d8401c09806eb7acbd0b04c7aa5364ff9
-
SSDEEP
98304:sGyR/dRFHyONyT1Gn7YumpwH2WUWACvP1YVbGI31iNO1oMuMvSSHTUG:spy+yUn7YumpwnAMP1YVbGIANOWMuMnl
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a2d78842c4c858205d405a92eaf3e1bb067eeb9a3864ba4166d74425f1ce8df0
Files
-
a2d78842c4c858205d405a92eaf3e1bb067eeb9a3864ba4166d74425f1ce8df0.exe windows:6 windows x86 arch:x86
8dd541051877f07a12968ef9eab3196f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ddraw
DirectDrawCreate
dsound
ord1
winmm
mmioClose
dinput
DirectInputCreateA
wsock32
WSAGetLastError
kernel32
FindNextFileA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
PostMessageA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
StretchDIBits
advapi32
RegCloseKey
shell32
ShellExecuteA
ole32
CoInitialize
lua51
lua_remove
netapi32
Netbios
dbghelp
MiniDumpWriteDump
imm32
ImmDestroyContext
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 983.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ