Behavioral task
behavioral1
Sample
5019ba2fea6c2b36dbc0119e40cd104697da4cbc8635c4771bf4df080198c04f.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5019ba2fea6c2b36dbc0119e40cd104697da4cbc8635c4771bf4df080198c04f.exe
Resource
win10v2004-20240508-en
General
-
Target
5019ba2fea6c2b36dbc0119e40cd104697da4cbc8635c4771bf4df080198c04f
-
Size
14.8MB
-
MD5
9caf663310dd4d76d8f5184bede63982
-
SHA1
dd2290d3fe414273c1578d0501a96053e07b55fe
-
SHA256
5019ba2fea6c2b36dbc0119e40cd104697da4cbc8635c4771bf4df080198c04f
-
SHA512
bdb1323827a348cfc5f547ef9c07e74201bfd8eb92c3fb2d9dd5758e11f505cc484836136b7326609b14e24b9ab19d685e2eeb2ca11f1ba6308b587f60c7cd2b
-
SSDEEP
393216:hbgiUPRuc86hJdNyfb0nl7vAXZreSbKt1BA3nj:jeucfdyDUp4XMSbYBA
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5019ba2fea6c2b36dbc0119e40cd104697da4cbc8635c4771bf4df080198c04f
Files
-
5019ba2fea6c2b36dbc0119e40cd104697da4cbc8635c4771bf4df080198c04f.exe windows:5 windows x86 arch:x86
8bdfd3db66c99e0688871bbfe42e1fe0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
wldap32
ord301
kernel32
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetWindowLongW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
shell32
SHGetSpecialFolderPathW
ole32
CLSIDFromProgID
shlwapi
wnsprintfW
crypt32
CertGetIntendedKeyUsage
comctl32
ord17
ws2_32
send
gdi32
SetBkColor
advapi32
CryptSignHashA
oleaut32
SysFreeString
gdiplus
GdipSetStringFormatFlags
imm32
ImmGetContext
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 567KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: - Virtual size: 592B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 13.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 14.8MB - Virtual size: 14.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ