Behavioral task
behavioral1
Sample
f991f902206d04b5013d8cf65903043b0112ea60704a10d7ba93a3ad8e7754ae.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
f991f902206d04b5013d8cf65903043b0112ea60704a10d7ba93a3ad8e7754ae.exe
Resource
win10v2004-20240508-en
General
-
Target
f991f902206d04b5013d8cf65903043b0112ea60704a10d7ba93a3ad8e7754ae
-
Size
8.4MB
-
MD5
6d888f6f8a28d124b1451f58d41e03e4
-
SHA1
6886b3215cb764a1284240d07504d74aac6bead1
-
SHA256
f991f902206d04b5013d8cf65903043b0112ea60704a10d7ba93a3ad8e7754ae
-
SHA512
fe7ad8a16f53d77f4f0831260198783bc9d9c369d195cec7c983314d065bb4f28623e48991e3ea140b25c6dee45869c6e8ef3f3b8ab3bfec40c0d115896372c4
-
SSDEEP
196608:MxcCCRhBa323NSQ6In0+KwyrqB+Y7KPhdGP3g7sSp:MxsRu32x6InXyHY7KhdGvg7v
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f991f902206d04b5013d8cf65903043b0112ea60704a10d7ba93a3ad8e7754ae
Files
-
f991f902206d04b5013d8cf65903043b0112ea60704a10d7ba93a3ad8e7754ae.exe windows:5 windows x86 arch:x86
60f308803830a0212893d62816948979
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
iphlpapi
GetAdaptersInfo
winmm
midiOutPrepareHeader
ws2_32
gethostname
kernel32
GetVersionExA
GetVersion
GetStringTypeA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxW
gdi32
CreateBitmap
winspool.drv
ClosePrinter
advapi32
RegDeleteValueA
shell32
ShellExecuteA
ole32
OleInitialize
oleaut32
VariantChangeType
comctl32
ord17
comdlg32
GetFileTitleA
Sections
.text Size: - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 7.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 392KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 8.4MB - Virtual size: 8.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 72KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ