Static task
static1
Behavioral task
behavioral1
Sample
a940fc6b4fea2a90133500eaeb752c09ea260aa4817d0cbbe60e1376c63afb72.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
a940fc6b4fea2a90133500eaeb752c09ea260aa4817d0cbbe60e1376c63afb72.exe
Resource
win10v2004-20240508-en
General
-
Target
a940fc6b4fea2a90133500eaeb752c09ea260aa4817d0cbbe60e1376c63afb72.exe
-
Size
5.9MB
-
MD5
e90137acd0cbc8dd463c671a54e79b6f
-
SHA1
7ff5b999bbc956b49ba98091650df75eef9f6c8d
-
SHA256
a940fc6b4fea2a90133500eaeb752c09ea260aa4817d0cbbe60e1376c63afb72
-
SHA512
d37053c590f6e7837803086fcd69387a6761c4383203ec02b7013e1044762c5ee228ed6768c1111172e41ec2744a0851ebbacbcf56006454053058f0b7913d03
-
SSDEEP
768:o5vWskoWdZYrsd6xt3TxdKROnzHML1ZJTofB0rPLICdJH6yzBv4qeTudFxyYe:ovSa86TVdzTMLHFJrPLIsH6yzBvoMSY
Malware Config
Signatures
-
Detects executables packed with VMProtect. 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_VMProtect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a940fc6b4fea2a90133500eaeb752c09ea260aa4817d0cbbe60e1376c63afb72.exe
Files
-
a940fc6b4fea2a90133500eaeb752c09ea260aa4817d0cbbe60e1376c63afb72.exe.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 449KB - Virtual size: 449KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 119KB - Virtual size: 118KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 72B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ