Behavioral task
behavioral1
Sample
eaf664f64ab69330d9cc1e61026d028da80332a7107529414b67ea10e8557e32.exe
Resource
win7-20240221-en
General
-
Target
eaf664f64ab69330d9cc1e61026d028da80332a7107529414b67ea10e8557e32
-
Size
14.8MB
-
MD5
47668a2f025be5bc1ebbee9cf56cdf46
-
SHA1
d11250189089fbc80c7e43f1ff8cf58d62d6506b
-
SHA256
eaf664f64ab69330d9cc1e61026d028da80332a7107529414b67ea10e8557e32
-
SHA512
1ed326010d8a7368e746c10c15658f590cb3a454c954a4905d970d58f47ac1389bd2c05da0e3a7418cd9ce441c3d04ad469c8700f568805850f9015bdc2dd01e
-
SSDEEP
393216:f1u6nWMiQlTyCzY0AID+TMBkJGRPTfnnEu3Q:fsOWZMz0hAkJufEY
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eaf664f64ab69330d9cc1e61026d028da80332a7107529414b67ea10e8557e32
Files
-
eaf664f64ab69330d9cc1e61026d028da80332a7107529414b67ea10e8557e32.exe windows:5 windows x86 arch:x86
3f759e51a61929d0e2b0d459f5c164cd
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamOut
ws2_32
WSAAsyncSelect
kernel32
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
PeekMessageA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
ExtTextOutA
winspool.drv
OpenPrinterA
advapi32
RegOpenKeyExA
shell32
Shell_NotifyIconA
ole32
CLSIDFromString
oleaut32
LoadTypeLi
comctl32
ord17
comdlg32
ChooseColorA
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 537KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 9.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 232KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 14.7MB - Virtual size: 14.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 56KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ