Behavioral task
behavioral1
Sample
5d78e9c1919057359f9951c812d72ddacb954e9aff0b30c5c65c1732f0000bfc.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
5d78e9c1919057359f9951c812d72ddacb954e9aff0b30c5c65c1732f0000bfc.exe
Resource
win10v2004-20240426-en
General
-
Target
5d78e9c1919057359f9951c812d72ddacb954e9aff0b30c5c65c1732f0000bfc
-
Size
10.0MB
-
MD5
824008c826f0b0b198963c6cf60fe445
-
SHA1
a2d04420b4e36d044265601deb43735f34a39ff5
-
SHA256
5d78e9c1919057359f9951c812d72ddacb954e9aff0b30c5c65c1732f0000bfc
-
SHA512
a4d5cc7a34836025f861a2f9609e49b0d101f4442df1278932e23713acf50b69277c93b6206ccb1d3c5968111a344dd5b576a1768d5140f0d1f6be8c672e263d
-
SSDEEP
196608:mgd9IPiUC5y9IjwApcg3NtT1IRnjjBGN4BI/2smFFK6xNOIkN:mgbQizyQwKJ3NajjgiGe1FFROI
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5d78e9c1919057359f9951c812d72ddacb954e9aff0b30c5c65c1732f0000bfc
Files
-
5d78e9c1919057359f9951c812d72ddacb954e9aff0b30c5c65c1732f0000bfc.exe windows:5 windows x64 arch:x64
1ba438b0cd323f112b341a69c6d908f7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetVersionExA
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
oleaut32
SysAllocStringLen
user32
MessageBoxA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
LookupAccountSidA
gdi32
CreateFontIndirectA
version
GetFileVersionInfoSizeA
shell32
DragQueryFileA
opengl32
wglUseFontBitmapsA
ole32
CoCreateGuid
comctl32
InitCommonControls
shlwapi
AssocQueryStringW
comdlg32
ChooseColorA
ntdll
ZwCreateSection
ws2_32
__WSAFDIsSet
wsock32
closesocket
imagehlp
StackWalk64
uxtheme
OpenThemeData
psapi
GetMappedFileNameA
hhctrl.ocx
HtmlHelpA
imm32
ImmGetContext
lua53-64
lua_close
wininet
InternetOpenA
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 7.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 620KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 5.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: - Virtual size: 402KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 204KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 652KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gnu_deb Size: - Virtual size: 40B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 9.9MB - Virtual size: 9.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 69KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ