Behavioral task
behavioral1
Sample
481e092a036efb3edaf363e2d7ba379a3b9e533cc4d278fcba2eb6723fbdb4c1.exe
Resource
win7-20240419-en
General
-
Target
481e092a036efb3edaf363e2d7ba379a3b9e533cc4d278fcba2eb6723fbdb4c1
-
Size
6.8MB
-
MD5
3481d09f291a9d9acdb0870b8d9a44fd
-
SHA1
2d9cc7117722a7a5db0f950d99c05b77e7b0b9e9
-
SHA256
481e092a036efb3edaf363e2d7ba379a3b9e533cc4d278fcba2eb6723fbdb4c1
-
SHA512
a27d8fe273f9d46d3009a6b12ab5e952d8487ccab266f255a23143ddb1a8cdfd9ee5d06b87d6b0e0b1e72681cc9615d0d3797355473e1d4eec16715ee7cdce02
-
SSDEEP
196608:iox1vjaUOqrUSAwzLm/1G2q0Ixw4RyuHMr:3djaU49G2q8Fr
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 481e092a036efb3edaf363e2d7ba379a3b9e533cc4d278fcba2eb6723fbdb4c1
Files
-
481e092a036efb3edaf363e2d7ba379a3b9e533cc4d278fcba2eb6723fbdb4c1.exe windows:5 windows x86 arch:x86
c7cc3853f8aa194cd732063edc9cba89
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamStop
ws2_32
WSACleanup
kernel32
GetVersionExA
GetVersion
GetFullPathNameA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
IsWindowEnabled
gdi32
CreateCompatibleBitmap
winspool.drv
ClosePrinter
advapi32
RegSetValueExA
shell32
Shell_NotifyIconA
ole32
CoGetClassObject
oleaut32
VariantInit
comctl32
ImageList_GetImageCount
oledlg
ord8
comdlg32
GetFileTitleA
Sections
.text Size: - Virtual size: 883KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 280KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 949KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 284KB - Virtual size: 281KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ