Behavioral task
behavioral1
Sample
e77368de222377b08e69da0b962b118160443bdcfdbefa3301423fd94f7579c1.exe
Resource
win7-20240215-en
General
-
Target
e77368de222377b08e69da0b962b118160443bdcfdbefa3301423fd94f7579c1
-
Size
4.7MB
-
MD5
ef6fefa3aad7a13636d713d48b7ae89c
-
SHA1
4d1cba8646e279422f84cd251e240f0909a7efea
-
SHA256
e77368de222377b08e69da0b962b118160443bdcfdbefa3301423fd94f7579c1
-
SHA512
3b23a5907b80605aceb43be6b3640669c8613c692744dc6f49f36d2d3a9dc00185c973bb79f76d946dcbfa3702e499aa14ab5757bf238d4b0b5a02f20b8876f0
-
SSDEEP
98304:T5r3FNiq4x5dncOikISvTMu+JWBDUn9ADNTcOLHoqJTyCollVn6TF:JXp4RJB7M/JW1Un9AL8qdoll9
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e77368de222377b08e69da0b962b118160443bdcfdbefa3301423fd94f7579c1
Files
-
e77368de222377b08e69da0b962b118160443bdcfdbefa3301423fd94f7579c1.exe windows:5 windows x86 arch:x86
4b11f8d79585ffe814e2b2fa3d6a6f72
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetVersion
GetVersion
GetVersionExA
TlsFree
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
ClientToScreen
gdi32
GetDeviceCaps
comdlg32
GetFileTitleA
wsock32
recv
wininet
InternetCrackUrlA
shell32
ShellExecuteA
ole32
CoCreateInstance
dbghelp
MakeSureDirectoryPathExists
winhttp
WinHttpTimeToSystemTime
shlwapi
PathFindExtensionA
oleaut32
SafeArrayGetElement
version
VerQueryValueA
advapi32
RegQueryValueA
gdiplus
GdipResetClip
psapi
GetModuleFileNameExA
ws2_32
WSAWaitForMultipleEvents
oledlg
ord8
rasapi32
RasGetConnectStatusA
winspool.drv
ClosePrinter
comctl32
ImageList_SetBkColor
winmm
midiOutReset
Sections
.text Size: - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 926KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 910KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 4.6MB - Virtual size: 4.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 96KB - Virtual size: 93KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ