Behavioral task
behavioral1
Sample
b63305d64b70dc783fe8e1c86042effa5d36bb275755a55415803b33bf30dc0d.exe
Resource
win7-20240220-en
General
-
Target
b63305d64b70dc783fe8e1c86042effa5d36bb275755a55415803b33bf30dc0d
-
Size
5.9MB
-
MD5
89f68d5b81bc021d0c253c77babee74c
-
SHA1
40a2f7cad6aacc75979e06caa4a38a3bc9435bf0
-
SHA256
b63305d64b70dc783fe8e1c86042effa5d36bb275755a55415803b33bf30dc0d
-
SHA512
455694787bc29de3ff4f1f301515ee4afff5afa1ed23d53ba312413a622e414bc66e7d5c1f58fec808354b488ad5deab2fbfa4dba7bffb351177f454492b6bfe
-
SSDEEP
98304:iox1vja88fCTSR/irXESAAYwzLxY/KAtY57CpRPq0h2xwAlpTRfLGuphM8:iox1vjaUOqrUSAwzLm/1G2q0Ixw4Ryus
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b63305d64b70dc783fe8e1c86042effa5d36bb275755a55415803b33bf30dc0d
Files
-
b63305d64b70dc783fe8e1c86042effa5d36bb275755a55415803b33bf30dc0d.exe windows:5 windows x86 arch:x86
c7cc3853f8aa194cd732063edc9cba89
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamStop
ws2_32
WSACleanup
kernel32
GetVersionExA
GetVersion
GetFullPathNameA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
IsWindowEnabled
gdi32
CreateCompatibleBitmap
winspool.drv
ClosePrinter
advapi32
RegSetValueExA
shell32
Shell_NotifyIconA
ole32
CoGetClassObject
oleaut32
VariantInit
comctl32
ImageList_GetImageCount
oledlg
ord8
comdlg32
GetFileTitleA
Sections
.text Size: - Virtual size: 883KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 280KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 949KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 284KB - Virtual size: 281KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ