Behavioral task
behavioral1
Sample
dec6d4354607e7976a20871cb618f584.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
dec6d4354607e7976a20871cb618f584.exe
Resource
win10v2004-20240226-en
General
-
Target
dec6d4354607e7976a20871cb618f584
-
Size
1.8MB
-
MD5
dec6d4354607e7976a20871cb618f584
-
SHA1
5fd5f6cde7b86828ff374f553f2903311f7c0ae7
-
SHA256
39a58e3bf94e4754285e7e3e9aeda604442fae9a036d2ad666d5013b0aa5dfb5
-
SHA512
bc6d62836865e2bfc02ff5ce86e50a2da28e02144241ff04d0551d4ce4596091c8a3ef51a8a1418e259dae00c423403625df30bc3904289354c333f8e5f7b6c9
-
SSDEEP
49152:MRbROmmZecfk0EdlXKlmgS7Lajf09Jn2L/tK/inlaFmAz4:FkJ0EdlXKlmVCM9Jng/XnlaFmAz
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dec6d4354607e7976a20871cb618f584
Files
-
dec6d4354607e7976a20871cb618f584.exe windows:5 windows x86 arch:x86
a4d26c1f77e5854452fadb44f02066f5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
wsock32
inet_addr
winmm
mixerGetControlDetailsW
version
GetFileVersionInfoW
comctl32
ImageList_Destroy
psapi
GetModuleBaseNameW
kernel32
GetVersionExW
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CheckMenuItem
gdi32
CreateFontW
comdlg32
GetOpenFileNameW
advapi32
OpenProcessToken
shell32
SHGetMalloc
ole32
CoInitialize
oleaut32
SafeArrayUnaccessData
Sections
.text Size: - Virtual size: 627KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 140KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 950KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 418KB - Virtual size: 417KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ