D:\VS2015\DunRunGate\Release\GameLogin.pdb
Behavioral task
behavioral1
Sample
795c98821168d62a12cb5cfcafb2a58c4addbd4f00954f76349a260d77817e3a.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
795c98821168d62a12cb5cfcafb2a58c4addbd4f00954f76349a260d77817e3a.exe
Resource
win10v2004-20240426-en
General
-
Target
795c98821168d62a12cb5cfcafb2a58c4addbd4f00954f76349a260d77817e3a
-
Size
8.0MB
-
MD5
a9b6df829e2f413e8fbd35632194e505
-
SHA1
8259f72ce35d1fa011dc920a68e37e9da534dec4
-
SHA256
795c98821168d62a12cb5cfcafb2a58c4addbd4f00954f76349a260d77817e3a
-
SHA512
bc8c58420eb5dcdb797897643d09a776b5eb8788159ef93e437738abb27a132d49f18adfb0a7ec168ae13bf939b29c26c5c4b1951ec4969501418532a8318d24
-
SSDEEP
196608:nWTtiF43GtoNRtdopjmQI3NFY6o4r98SH9tQ2:Km43Gto/tdoQ0S6E9tx
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 795c98821168d62a12cb5cfcafb2a58c4addbd4f00954f76349a260d77817e3a
Files
-
795c98821168d62a12cb5cfcafb2a58c4addbd4f00954f76349a260d77817e3a.exe windows:5 windows x86 arch:x86
6aff28ea56fbc274827ce604114be37f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetVersionExA
FindFirstFileW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SystemParametersInfoA
gdi32
SelectClipRgn
advapi32
ReportEventW
shell32
SHGetSpecialFolderPathA
ole32
CLSIDFromString
oleaut32
SysStringLen
shlwapi
PathIsDirectoryA
comctl32
_TrackMouseEvent
wininet
HttpQueryInfoA
ws2_32
socket
psapi
GetProcessImageFileNameA
crypt32
CertEnumCertificatesInStore
Sections
.text Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 583KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.4MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ