Behavioral task
behavioral1
Sample
498b820f2c21d9b30180ac5e82a2cc581aa2b76fb5ae3272b4e6f1898209c72b.exe
Resource
win7-20240221-en
General
-
Target
498b820f2c21d9b30180ac5e82a2cc581aa2b76fb5ae3272b4e6f1898209c72b
-
Size
1.3MB
-
MD5
0bf558adde774215bb221465a4edd2fe
-
SHA1
0576fbd12c98d9338f3d793f6277ee110b6b7a19
-
SHA256
498b820f2c21d9b30180ac5e82a2cc581aa2b76fb5ae3272b4e6f1898209c72b
-
SHA512
c2a264ce583e525c9e0a6fa128006080565905c7a703df5866287e9cca5ca310d1f32642d6db43df4471a0be05020c01d64b3049f6fc920e5010293db948020c
-
SSDEEP
24576:1qFotyJmKb6CL1T2CjJ3+P+g5W32EI6WTbSXuewtEawDiTx1L54nztJg7gOTx:EwWx1jomg5WmpfzMCvt4nBSN
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 498b820f2c21d9b30180ac5e82a2cc581aa2b76fb5ae3272b4e6f1898209c72b
Files
-
498b820f2c21d9b30180ac5e82a2cc581aa2b76fb5ae3272b4e6f1898209c72b.exe windows:5 windows x86 arch:x86
abe185e44c89b73600340e95ebfb4dfe
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
IsDebuggerPresent
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
shell32
SHGetSpecialFolderPathW
shlwapi
PathAppendA
bcrypt
BCryptDecrypt
crypt32
CryptUnprotectData
user32
wsprintfW
Sections
.text Size: - Virtual size: 577KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 919KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 240B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ