Behavioral task
behavioral1
Sample
c6ef89dbead03ff25892f70b369697f1.exe
Resource
win7-20240221-en
General
-
Target
c6ef89dbead03ff25892f70b369697f1.bin
-
Size
1.6MB
-
MD5
c6ef89dbead03ff25892f70b369697f1
-
SHA1
e7b34167088018a6b22681d2f4c6ca0b18147908
-
SHA256
c97c255e79b870514ed4cedcb847a26c13bd2d96d484ae5ae6efc479a8ec0630
-
SHA512
f334c7d176e6f567eb6626d6a5f0e97fb8ac73a03b2baf6052b7577343d989c82df795a913db53265681703be2501394a674c69179ddf4f84e45fd1cf4fe67fb
-
SSDEEP
24576:jTPZWU2Cm2yxqHDFAmabwWHJqV1h261b7AT0NzNPZ+c6hrkf265lxxKmbcCY:jTQUU2yxqHpAmafJ81b+T0NxP69gZ8
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c6ef89dbead03ff25892f70b369697f1.bin
Files
-
c6ef89dbead03ff25892f70b369697f1.bin.exe windows:5 windows x86 arch:x86
e772eb609dba3b8fc3b3089be145896d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
HeapCreate
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
ole32
OleInitialize
oleaut32
SafeArrayUnaccessData
mscoree
CorBindToRuntimeEx
user32
MessageBoxW
Exports
Exports
/Vg�Z^g �ʲ�,��d> �uS��=���Z�l䋺�����>��a����D�E� B����TpC{�N\��~��3D��$���#J�V]��H���'5��C`���MV�H5��Xu�ҫ�q�FQ�Z7��ܦ���E!� ��f@�)��jv��i�w�5��.O ���FJ���o��b��6��R��z�è�b�)x�:���T��z��ٞL���Z��y[2N3^���!�~iи�l(�d�5`_�D6�dKk�o�(��R�W�d���O����M�.Q��d��� 7���^����5�]j��Q��)��[ӆ���9����뺕5]�J^&����U��L#��B�笪��}%YM.u�A���^�q����ᘰA��_�kދY?D���<c[Ҳ&��-��θ+R�NhX` w&ֲ�;��� �`XKW��yT���n�ӆ��&�����[�I��Doo[ O�I�;ϐ v�����>�i)x2���h ����܈�����T�o�C�� z+�'�q���-I�4�h����jf��.ah�b�Ӛ˘���!t('-�4=K,�PIY��8O�"~-���c��M>? �s��FUFQ".�V�@��NύZ�Iu C���02)oߖ쩠�>�K����@s�Tpo�Q���>��ȣY��&C��j4��Ly.+`���<��vָY� ��?/ݥ�cH� >�������KO�ܽ�NJ�>(j�h�S����#�����$*?|%�#<����Єc�m�k$ۑ&ay:�iSB���H1��(4���l�0ŗJC�_4�*�T%SϾ���u�Y�%�Xd˴�����������bzM�ޖ��B�<A�>��4R{,��%t�į^xf�߬���ޠ(���[���Բ{�}#lV6Z�>ב�}��E�����7+*��-�@�C��/�6Mtھ���"ݖ��AM����'���wD)ge�&;�OT�6�q�ܻ��I�� ��^Վ�mj� ��V�x�ѰC`��������pa �J�����@`h� �i����$xG�4pB�e�A?�c��c����ɺ3�J�C��=�_�u�?��`��BK�r�SN��8�H��Ȣ@������R��)���%�=�4�/�+�����l ��;i�E�Ye��oH��|���YS� �t�z��1.�}�ֆ� �l� �0��-��S4����S �P]�ӣ�]Ś�}�y�t�!y��T`�����ӛ-�����I�A�}��M�Z˕�-,�D���zJ ����=�p�̐��R!���u�B!{rm��g<9^m��w�m��dN��{lƉ7�+*�)`>�)H!R��j���))6��&)��-"����ZB ~,���}��t�V|^J���մ�{�β�#K>I�(v���F4�y������q��B�:�J�~U�Z-�<�u����|(�V����x����#��1zy�˭j�u-���d�`���Y��[ �=��ڂ~@.]Fl�d 9������f���x4Tz�J<�J�no%ꆸե�^�]Q���,��F�ާ|+s~�xR����;��T��ˮa)ԕ�=9�����>��&t�k��5�� �t�:�·��)�ފ���CLu�aE��b�fQ�I��וE�h�Z��1��@�v�AM�u%oI�M[^#m�{Zn�p���\�VE[����3馃��:�C�A�Uo�hU[?�� ����TK���k GK$��%� '�±�s�e����!<蹼V���)~�E����� ��۩mf1��"N��B���J�� �K#� -^.�)�9�3`t6$wN�`E���V�����)�K�i>Pf,�92V���t���BNϿ!5v��!�vհ�Q`NF̓����5.�趌C"�,dR�����Ơ2�\H�Q��� x�7ރǠdp� ������ �a&~�f� �h�`T�\��b�}l��XDΟ�0�";� 4*H()v��3=��E��b ��xX��D�"Q��O��B����J17j�������P�<�hb��;��%=��Q��6��m��Zr���'��hfB�E��G]��M�I���{�=�ќ{����P�$�Q��M�1�PPڭ˝Z���� ��dP�"�ջ �zƽ��f�$8'�G�݅��=� ���K�e�����A� ��7���ʈ�Юi�#Yp6��wT3���W���{�{�}�D" ������a���9���A��`�Z3-���٘S �c�y����vH�Ҁ�Y���Sw,�j��_a�E�JQ���NR6{3�%�56�=: �o}�w�2Jq�p���Ol�6~�� �>�M"����!V�� bW��Zs�&�.�&l|�lbn���6E�!����;�ySpĿ=������Zh��Ͽ�8�*\,��0�@..��X��]��v�|��n3���g�Y��N�z"�Aj�� �ް�z"���o�AA�'Y�7���[x��o����)���;����&�nb0��ո�O�ܑ�E���� #t[{*uR�!Q�!�Oq���A/��-;?���7�.S�� W���|#� �$�,�jyT 3�mEPx>�RB�KH�q� (���a ��EU�n�o������MuV�i�HYv�;br�� _�/G��C��U�?$���'\ضWWɭ&[�ԧ�Ź��A�Q���~�ᛞA�Ij��%��� U�Х(Ԣ��{����d�Գ�pA��-�r��Ӿ�#��-OҘ�9�+y�������.�Yx����B�6+�9D�o���5���������6�.2��Uƃ(���yc��������q�Bn��k��sA�9�7��������m��W=����;�7���/�����@�4�W�@ ���rb�����2��f��p>��;Y��Y|�$� i�+i�2��Ox6,u<�-�n�룕�u{���;cgM'B�ͱ�T{��T�j�/�c���+0�8V:��8�_���������R�V9 AJ��3Sˠz#y�n!�hM���3F�7�ۻ �!?D��צ�¼+�+�FӕMr�*F����� ��
Sections
.text Size: - Virtual size: 101KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE