Behavioral task
behavioral1
Sample
d6d90a406b0d9c060bff2dc4c1730546.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d6d90a406b0d9c060bff2dc4c1730546.exe
Resource
win10v2004-20240226-en
General
-
Target
d6d90a406b0d9c060bff2dc4c1730546
-
Size
620KB
-
MD5
d6d90a406b0d9c060bff2dc4c1730546
-
SHA1
0bf01d735680eb1b4bf3d95353135e960df0ca3e
-
SHA256
2741ca05ee770adc359c9393026b24c6ba1d726a937809cf9f3ba1d31f65b32d
-
SHA512
e24eae9053e33fa800acd8531e942d226ce0796d043db281f48f36401258141ff12838a72535036598e83bc9b16f9195cfcebbd37f0a9cf2d45023d6522a00bd
-
SSDEEP
12288:V6bThj3yp9TnVqeSxaZG6S+aO3dAJM6eMdvN9+z97ngUl2NvnP+L1iJt2k:gPhj+9TnMeSxaE6S+aAAJM6vMuU2nmiC
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d6d90a406b0d9c060bff2dc4c1730546
Files
-
d6d90a406b0d9c060bff2dc4c1730546.exe windows:4 windows x86 arch:x86
80bbb58b2e7f18d2098ab4419da6b2ef
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GlobalReAlloc
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetCursorPos
MessageBoxA
gdi32
RoundRect
winmm
midiOutPrepareHeader
winspool.drv
DocumentPropertiesA
advapi32
RegQueryValueA
shell32
Shell_NotifyIconA
ole32
OleInitialize
oleaut32
UnRegisterTypeLi
comctl32
ImageList_Destroy
ws2_32
getpeername
comdlg32
ChooseColorA
Sections
.text Size: - Virtual size: 430KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 83KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 121KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 256KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp2 Size: 568KB - Virtual size: 566KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ