Static task
static1
Behavioral task
behavioral1
Sample
7e12f99ff730b95395f862a784a45ac56d87b424c0df1d152f2f6e54b4c915aa.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7e12f99ff730b95395f862a784a45ac56d87b424c0df1d152f2f6e54b4c915aa.dll
Resource
win10v2004-20240508-en
General
-
Target
7e12f99ff730b95395f862a784a45ac56d87b424c0df1d152f2f6e54b4c915aa
-
Size
405KB
-
MD5
82e84d2fe3b778656fa6c005b0d04ca5
-
SHA1
a5a822f387f242bc31876d93f9de8e668f581db1
-
SHA256
7e12f99ff730b95395f862a784a45ac56d87b424c0df1d152f2f6e54b4c915aa
-
SHA512
11f4252a8f27fc5ca39db8ad1693bb12b44b8c86168c4e65153a281524e5cdeac2486fbc93336c013cb2b283c0ac34b24104231aa2dbb6226dfe09f4ca0b4772
-
SSDEEP
3072:J1VKoOPZ5IsY9wt9Ok0MKSNzJFF5nJYNXpGMdjiWw8QfqM6+M+RJ2171xPLQdfv:hwPXIscwttHK69F/YXs07w8oTQfK
Malware Config
Signatures
-
Detects executables packed with VMProtect. 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_VMProtect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7e12f99ff730b95395f862a784a45ac56d87b424c0df1d152f2f6e54b4c915aa
Files
-
7e12f99ff730b95395f862a784a45ac56d87b424c0df1d152f2f6e54b4c915aa.dll windows:5 windows x86 arch:x86
fd9982c88154d106cee97bc165cc0305
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetModuleHandleW
GetTickCount
Sleep
GetModuleFileNameW
CreateFileW
GetLastError
GetProcAddress
VirtualProtect
GetCurrentThreadId
CloseHandle
GetCurrentProcessId
GetThreadContext
VirtualQuery
GetCurrentThread
InitializeCriticalSection
LeaveCriticalSection
SetThreadPriority
FlushInstructionCache
VirtualAlloc
EnterCriticalSection
OpenThread
GetSystemInfo
GetThreadPriority
SuspendThread
GetCurrentProcess
InitializeCriticalSectionAndSpinCount
CreateEventW
DeleteCriticalSection
SetFilePointer
WaitForSingleObject
SetEvent
WriteFile
WideCharToMultiByte
lstrlenW
GetLocaleInfoA
GetStringTypeW
ResumeThread
CreateFileA
GetStringTypeA
LCMapStringW
LCMapStringA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
LoadLibraryA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetStartupInfoA
GetFileType
SetHandleCount
GetModuleFileNameA
GetStdHandle
VirtualFree
ExitProcess
TlsFree
TlsSetValue
GetModuleHandleA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RaiseException
HeapCreate
lstrlenA
InterlockedIncrement
MultiByteToWideChar
lstrcpyW
SetLastError
ResetEvent
InterlockedDecrement
GetFileSize
UnmapViewOfFile
MapViewOfFileEx
CreateFileMappingW
GetNativeSystemInfo
ExitThread
CreateThread
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
GetCommandLineA
RtlUnwind
TlsGetValue
TlsAlloc
user32
MessageBoxW
iphlpapi
GetBestInterface
ws2_32
WSAResetEvent
send
WSAWaitForMultipleEvents
WSAIoctl
inet_ntoa
htons
ntohs
WSACreateEvent
shutdown
closesocket
gethostbyname
WSAStartup
WSAGetLastError
WSACleanup
inet_addr
socket
recv
WSAEventSelect
WSAEnumNetworkEvents
connect
WSACloseEvent
getsockname
Sections
.text Size: 122KB - Virtual size: 122KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 156KB - Virtual size: 180KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 81KB - Virtual size: 80KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 434B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ