D:\VS2015\DunRunGate\Release\GameLogin.pdb
Behavioral task
behavioral1
Sample
fa4612310415dd7deece74c25a106723e026e9823ce84bb642e77f75ee50ef57.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
fa4612310415dd7deece74c25a106723e026e9823ce84bb642e77f75ee50ef57.exe
Resource
win10v2004-20240508-en
General
-
Target
fa4612310415dd7deece74c25a106723e026e9823ce84bb642e77f75ee50ef57
-
Size
8.2MB
-
MD5
7f43c3eb429ba295fd67228cb8c983d9
-
SHA1
35fbdaf4a3786f7047e951843098582059270f21
-
SHA256
fa4612310415dd7deece74c25a106723e026e9823ce84bb642e77f75ee50ef57
-
SHA512
093f8932a9f971c3288590c1f4dc31bb930e8067c300ea91f1dcb681d5853c94f3a07dd6f5225791075fa4b8e28f7c8ead85d53dd9cd55cfa9a1fc4ecc0e7883
-
SSDEEP
196608:nWTtiF4xO0Z1+5AtYHGIn9uweL7o+JktFvvvZb36M:Km4xP+OY9udLs+KtZvJj
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fa4612310415dd7deece74c25a106723e026e9823ce84bb642e77f75ee50ef57
Files
-
fa4612310415dd7deece74c25a106723e026e9823ce84bb642e77f75ee50ef57.exe windows:5 windows x86 arch:x86
6aff28ea56fbc274827ce604114be37f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetVersionExA
FindFirstFileW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SystemParametersInfoA
gdi32
SelectClipRgn
advapi32
ReportEventW
shell32
SHGetSpecialFolderPathA
ole32
CLSIDFromString
oleaut32
SysStringLen
shlwapi
PathIsDirectoryA
comctl32
_TrackMouseEvent
wininet
HttpQueryInfoA
ws2_32
socket
psapi
GetProcessImageFileNameA
crypt32
CertEnumCertificatesInStore
Sections
.text Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 583KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.4MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ