Behavioral task
behavioral1
Sample
cbcbefbc10fa88b156db666a9df211c9c04c2f66aa42495bda3f25af55bf4cde.exe
Resource
win7-20240221-en
General
-
Target
cbcbefbc10fa88b156db666a9df211c9c04c2f66aa42495bda3f25af55bf4cde
-
Size
11.2MB
-
MD5
2926a7d348eb0f89ff3c3e59b271a3a4
-
SHA1
e7e35196a3ca3fccadadce21700ae1515ff34fe5
-
SHA256
cbcbefbc10fa88b156db666a9df211c9c04c2f66aa42495bda3f25af55bf4cde
-
SHA512
3240af1e2320b5d0fca6edfab62e083bd9978d539b44c4c06cb9c706441fcac0b344bccb07c1dc66a4dc63d6d4d5625bc8962cab80e2c926bf65258550cc89a1
-
SSDEEP
196608:mSKpDl2egdjGSArEsD06iIDBnBax4gBWZGbepvbI4BlRidr7j/yL7:hKpDl2eg9u3ganBvUTCpvJXUlSL7
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cbcbefbc10fa88b156db666a9df211c9c04c2f66aa42495bda3f25af55bf4cde
Files
-
cbcbefbc10fa88b156db666a9df211c9c04c2f66aa42495bda3f25af55bf4cde.exe windows:5 windows x86 arch:x86
8c47fbe309ce30dbd3a92a7d2dfba560
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvfw32
DrawDibDraw
avifil32
AVIStreamInfoA
iphlpapi
GetAdaptersInfo
winmm
midiStreamOut
ws2_32
getsockname
version
GetFileVersionInfoSizeA
kernel32
GetVersion
GetVersionExA
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetSysColorBrush
CharUpperBuffW
gdi32
CreateFontIndirectA
winspool.drv
OpenPrinterA
comdlg32
GetFileTitleA
advapi32
RegCreateKeyExA
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
shell32
SHGetSpecialFolderPathA
ole32
CLSIDFromProgID
oleaut32
VariantInit
comctl32
ord17
wldap32
ord29
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 619KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 9.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 11.2MB - Virtual size: 11.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 288B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ