Behavioral task
behavioral1
Sample
096c16307d1935159ddca3cf4958659cc6af2362413b5f1e99e2e5fe31e416c0.exe
Resource
win7-20240221-en
General
-
Target
096c16307d1935159ddca3cf4958659cc6af2362413b5f1e99e2e5fe31e416c0
-
Size
1.7MB
-
MD5
6eeeccfb192e76ece69dbddc7db4b669
-
SHA1
99dbbbcdfe00383d1afb18b24503c0cb797a0ba5
-
SHA256
096c16307d1935159ddca3cf4958659cc6af2362413b5f1e99e2e5fe31e416c0
-
SHA512
727e2b09aa4d9f6d7e9774d2ca39bf8b2ff939909018c2056341bc972334141ae3e13cab52cfd6ff3cf9070161be56ca9b5383e706f80178107009d04d33a69c
-
SSDEEP
49152:dTd5bLCC8JgTXu/CxnHmK8QXYB/aJ+SvHtg1Zf9yCIVk+Z:3lYOKqnlYBq+qtgTf9Zq
Malware Config
Signatures
-
Detects executables packed with VMProtect. 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_VMProtect -
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 096c16307d1935159ddca3cf4958659cc6af2362413b5f1e99e2e5fe31e416c0
Files
-
096c16307d1935159ddca3cf4958659cc6af2362413b5f1e99e2e5fe31e416c0.exe windows:5 windows x86 arch:x86
3cacfa333f4f2d914b23d99468dd2950
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamProperty
ws2_32
inet_ntoa
rasapi32
RasHangUpA
kernel32
GetProcessVersion
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetWindowRgn
gdi32
FillRgn
winspool.drv
DocumentPropertiesA
advapi32
RegOpenKeyExA
shell32
Shell_NotifyIconA
ole32
OleInitialize
oleaut32
LoadTypeLi
comctl32
ImageList_Destroy
wininet
InternetCloseHandle
comdlg32
ChooseColorA
Sections
.text Size: - Virtual size: 453KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 318KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 760KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ