Behavioral task
behavioral1
Sample
698952bb9e85dbef5b253b2561d61026d87832388b420cb91332408c95e1427b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
698952bb9e85dbef5b253b2561d61026d87832388b420cb91332408c95e1427b.exe
Resource
win10v2004-20240426-en
General
-
Target
698952bb9e85dbef5b253b2561d61026d87832388b420cb91332408c95e1427b
-
Size
10.8MB
-
MD5
e00e056a3bda2404992af8b6a3e4322c
-
SHA1
aadd080cf952ead619a4e4964f84b7b1f7dd59b1
-
SHA256
698952bb9e85dbef5b253b2561d61026d87832388b420cb91332408c95e1427b
-
SHA512
04c3136fc6143306a38d19ad21813fc3e8e60748107620418c6c18bc0969f69d6e84ee00d9ae32783bfd91669974b7b35208afbeec6fe33e6d7bc80ea5ff46cd
-
SSDEEP
196608:nF96mteVte6SqLYe+OTOgahRysUtdKjalQnlLZQENU5bm6Csv1H1t:F5ct/Ye16pksUHKjTZZUZn1/
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 698952bb9e85dbef5b253b2561d61026d87832388b420cb91332408c95e1427b
Files
-
698952bb9e85dbef5b253b2561d61026d87832388b420cb91332408c95e1427b.exe windows:6 windows x86 arch:x86
80a164c4ed9e2c84a72f22e6887efdd4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
WSAEventSelect
crypt32
CertGetCertificateContextProperty
kernel32
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
LoadMenuA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
Polygon
msimg32
TransparentBlt
winspool.drv
OpenPrinterA
advapi32
CryptSignHashW
shell32
Shell_NotifyIconA
comctl32
_TrackMouseEvent
shlwapi
StrChrA
uxtheme
DrawThemeBackground
ole32
CoUninitialize
oleaut32
SysAllocString
oledlg
ord8
urlmon
URLDownloadToFileA
gdiplus
GdipDrawImageRectI
netapi32
Netbios
winmm
timeGetTime
bcrypt
BCryptGenRandom
oleacc
LresultFromObject
imm32
ImmReleaseContext
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 854KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 124KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 8.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 10.8MB - Virtual size: 10.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ