Behavioral task
behavioral1
Sample
5a67d1dd9f0e3ae1ee5ab2778eaca0f834522440c453080b92f00d0bc8e46c21.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5a67d1dd9f0e3ae1ee5ab2778eaca0f834522440c453080b92f00d0bc8e46c21.exe
Resource
win10v2004-20240508-en
General
-
Target
5a67d1dd9f0e3ae1ee5ab2778eaca0f834522440c453080b92f00d0bc8e46c21
-
Size
3.9MB
-
MD5
0175219b520759afa2a138a9d8ed5857
-
SHA1
290cc14bf8aa12b65ab33ea9273c7e8c6a81e82e
-
SHA256
5a67d1dd9f0e3ae1ee5ab2778eaca0f834522440c453080b92f00d0bc8e46c21
-
SHA512
259dc81ab8019f883c805e404666d0c92437cd3f9bfb14e9b63e1f63d147bb859613e37e9b00ca1f393c6bdbf4a9d10681f7d6239c04645c737e2a85812cae7b
-
SSDEEP
98304:GqYwm+ZDfoGfN5aU85NlmNhyvm8M75lZatO+r0:dXoG5hyfu5lYH4
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5a67d1dd9f0e3ae1ee5ab2778eaca0f834522440c453080b92f00d0bc8e46c21
Files
-
5a67d1dd9f0e3ae1ee5ab2778eaca0f834522440c453080b92f00d0bc8e46c21.exe windows:4 windows x86 arch:x86
e5367379632ef276ff288c3a48a3d97f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiOutReset
ws2_32
gethostbyname
version
GetFileVersionInfoA
rasapi32
RasHangUpA
msvfw32
DrawDibDraw
avifil32
AVIStreamInfoA
kernel32
FormatMessageA
GetModuleHandleA
GetProcAddress
VirtualProtect
user32
SendDlgItemMessageA
MessageBoxA
gdi32
PatBlt
msimg32
GradientFill
winspool.drv
ClosePrinter
comdlg32
GetFileTitleA
advapi32
OpenProcessToken
shell32
DragFinish
ole32
CoGetClassObject
oleaut32
LoadTypeLi
comctl32
ImageList_Add
oledlg
ord8
wininet
InternetCloseHandle
Sections
.text Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 650KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 76KB - Virtual size: 97KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 3.9MB - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 108B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ