Behavioral task
behavioral1
Sample
7393b51d6b95d9eea885f5a8c80ab713e69258560d8d1e8e7424f57cc4a023b0.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
7393b51d6b95d9eea885f5a8c80ab713e69258560d8d1e8e7424f57cc4a023b0.exe
Resource
win10v2004-20240426-en
General
-
Target
7393b51d6b95d9eea885f5a8c80ab713e69258560d8d1e8e7424f57cc4a023b0
-
Size
2.9MB
-
MD5
42fde3446327bc1f58f92b8464913e9a
-
SHA1
a35d49d64aba9d9f29ab18dd43ad97c927452df0
-
SHA256
7393b51d6b95d9eea885f5a8c80ab713e69258560d8d1e8e7424f57cc4a023b0
-
SHA512
08e9e1f1814b737be371bc2912c006608bf1ffaa1bf1a279a9720ef15e3c88e556c44f9d13bba09dac90603e1cf2f9d862b77d3fc94f3504d582fd7daa56c17d
-
SSDEEP
49152:YuDV2eKXVwenGLXjveVnjeu6D1b4dy5HlNhe9m+Xgi3Zxm+6iXbVO:3Q5wensXTeF+1b4g5punXgiV6iXI
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7393b51d6b95d9eea885f5a8c80ab713e69258560d8d1e8e7424f57cc4a023b0
Files
-
7393b51d6b95d9eea885f5a8c80ab713e69258560d8d1e8e7424f57cc4a023b0.exe windows:5 windows x86 arch:x86
10f2360d952d6eecac2191f46b4d5f94
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExW
GetVersionExA
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
RegisterClipboardFormatW
CharUpperBuffW
gdi32
ExtSelectClipRgn
comdlg32
GetFileTitleW
winspool.drv
DocumentPropertiesW
advapi32
RegCreateKeyExW
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
shell32
SHGetFileInfoW
comctl32
_TrackMouseEvent
shlwapi
PathFindExtensionW
oledlg
OleUIBusyW
ole32
CoFreeUnusedLibraries
oleaut32
SysFreeString
version
GetFileVersionInfoW
psapi
GetProcessImageFileNameW
iphlpapi
GetAdaptersInfo
rpcrt4
UuidCreateSequential
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 321KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 71KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 185KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.maopo Size: - Virtual size: 1.0MB
IMAGE_SCN_MEM_EXECUTE
.vmp1 Size: - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 268B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 173KB - Virtual size: 173KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ