Behavioral task
behavioral1
Sample
f9541177fa7f4b302f68bb84936345dd08cf3ade10ef4a1d0548c47aef7962b6.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f9541177fa7f4b302f68bb84936345dd08cf3ade10ef4a1d0548c47aef7962b6.dll
Resource
win10v2004-20240426-en
General
-
Target
f9541177fa7f4b302f68bb84936345dd08cf3ade10ef4a1d0548c47aef7962b6
-
Size
1.1MB
-
MD5
f6d442a0bb93e14a361eccbcacbfdc1a
-
SHA1
66fa143c6ce38338cebbfe3dc3f988bd32d7850a
-
SHA256
f9541177fa7f4b302f68bb84936345dd08cf3ade10ef4a1d0548c47aef7962b6
-
SHA512
c3128d4879ca62d5e9411012f648d849fb8f90735e845648ce95c5da459b4f1a59a2bb2713002fd015a8ff0fb172ef46c95df491168175e921563bf492dbcf9b
-
SSDEEP
24576:j67AqoEHP7mWhvaUikTcBHSsw2XODmq5BiqJ84AX45iWvhr:ucqbhv2HbeDDBiqJ84/5lvh
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f9541177fa7f4b302f68bb84936345dd08cf3ade10ef4a1d0548c47aef7962b6
Files
-
f9541177fa7f4b302f68bb84936345dd08cf3ade10ef4a1d0548c47aef7962b6.dll windows:5 windows x86 arch:x86
19225f5e75511aaf60daa6be09fe3e8c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
WriteConsoleW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetWindowTextLengthA
gdi32
Rectangle
ole32
CLSIDFromProgID
oleaut32
SysAllocString
shell32
DragQueryFileA
Sections
.text Size: - Virtual size: 999KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 163KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 77KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
xg Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 133KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 54KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 519KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ