Behavioral task
behavioral1
Sample
e224baf8fbb5af9983996c6db307b6a4.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e224baf8fbb5af9983996c6db307b6a4.exe
Resource
win10v2004-20240226-en
General
-
Target
e224baf8fbb5af9983996c6db307b6a4
-
Size
68KB
-
MD5
e224baf8fbb5af9983996c6db307b6a4
-
SHA1
105788bc754b1fc3d8815a690bbd415ce92d59bd
-
SHA256
863ba782fb28474f5a524acd67941b8d31a86db1c36d4cebdfab56f334db225c
-
SHA512
dfbad720fcd3e16222d5bda3d2f9d420202ca72ac71f72fd5f11c825a8955944289d395d98948bea44ef0cc354cb1dd5e17f099f471caf7a5ae80c15a7f9f3d5
-
SSDEEP
1536:CNEKe8lYoGe2EP8+rvmvq9e5QSpeQ9KReomv1T6:CNE9ibrev9NpeQsReomv1
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e224baf8fbb5af9983996c6db307b6a4
Files
-
e224baf8fbb5af9983996c6db307b6a4.exe windows:4 windows x86 arch:x86
655892c38caa12e5e15611ac1a552e55
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
EnumWindows
CloseClipboard
VkKeyScanA
keybd_event
IsWindow
SetFocus
wsprintfA
BlockInput
OpenClipboard
EmptyClipboard
SetClipboardData
GetWindowTextA
CharLowerA
FindWindowA
ShowWindow
BringWindowToTop
SetForegroundWindow
MessageBoxA
ole32
CoInitialize
CoCreateInstance
CoUninitialize
oleaut32
SysAllocString
VariantClear
SysFreeString
VariantInit
urlmon
URLDownloadToFileA
kernel32
GlobalUnlock
GetStartupInfoA
WideCharToMultiByte
TerminateThread
lstrcpyA
lstrcmpA
lstrcpynA
GetSystemTime
ReadFile
InterlockedDecrement
GlobalLock
FindFirstFileA
SetCurrentDirectoryA
GetFullPathNameA
FindNextFileA
FindClose
GetFileSize
SetFilePointer
Sleep
GetTempPathA
GetLastError
CreateThread
ExitProcess
lstrcmpiA
WaitForSingleObject
CreateProcessA
ExpandEnvironmentStringsA
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
LoadLibraryA
CloseHandle
GetCurrentProcess
ExitThread
ReleaseMutex
GetTickCount
CreateMutexA
GetLocaleInfoA
GetVersionExA
GetFileAttributesA
CopyFileA
SetFileAttributesA
GetWindowsDirectoryA
WriteFile
CreateFileA
lstrlenA
CreateDirectoryA
lstrcatA
GetDriveTypeA
GetLogicalDriveStringsA
GlobalFree
GlobalAlloc
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
VirtualProtect
GetModuleFileNameA
ExitProcess
msvcrt
_EH_prolog
atoi
wcslen
__dllonexit
_onexit
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
__CxxFrameHandler
strstr
strlen
strcpy
rand
sprintf
strchr
memset
_snprintf
memcmp
strncpy
srand
strtok
strcmp
_vsnprintf
??2@YAPAXI@Z
memcpy
strcat
free
malloc
_except_handler3
advapi32
GetUserNameA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegDeleteValueA
RegCreateKeyExA
ws2_32
connect
socket
ioctlsocket
closesocket
Sections
.text Size: - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 277KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 60KB - Virtual size: 59KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 112B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ