Static task
static1
Behavioral task
behavioral1
Sample
cba63e0abff7ee7da9aa82f716fa596d90d77f40166affc3f43c5b0384f2e982.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
cba63e0abff7ee7da9aa82f716fa596d90d77f40166affc3f43c5b0384f2e982.exe
Resource
win10v2004-20240611-en
General
-
Target
cba63e0abff7ee7da9aa82f716fa596d90d77f40166affc3f43c5b0384f2e982.exe
-
Size
46KB
-
MD5
cd0bbabcca88a643ab18345bbe729487
-
SHA1
f910393f4a12ccc40c9777eddd7480b8914e46ee
-
SHA256
cba63e0abff7ee7da9aa82f716fa596d90d77f40166affc3f43c5b0384f2e982
-
SHA512
95f97a91f1d78b6c712f80dc0c9b7b91f072e00502337b09564b3cba269e2b82a0ce855b01e132931f07fefa655764599783ae997043a014bcdcaebf1f8cb3be
-
SSDEEP
768:GDz1o25TTjRglbHEHgz0lA6tGMhpIHVnAHF7ZkDwXo7Z7uEFq+gIW81Qm775:U+iTTIbvf6nM1AHF73o91FqfI0m775
Malware Config
Signatures
-
Detects executables packed with VMProtect. 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_VMProtect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cba63e0abff7ee7da9aa82f716fa596d90d77f40166affc3f43c5b0384f2e982.exe
Files
-
cba63e0abff7ee7da9aa82f716fa596d90d77f40166affc3f43c5b0384f2e982.exe.exe windows:5 windows x64 arch:x64
66a76438aae4895269af9cbab80f4b40
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
LoadLibraryW
GetProcAddress
GetCommandLineW
GetStartupInfoW
GetLastError
HeapFree
EncodePointer
DecodePointer
HeapAlloc
RaiseException
RtlPcToFileHeader
SetUnhandledExceptionFilter
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
RtlUnwindEx
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
HeapSetInformation
GetVersion
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
Sleep
HeapSize
LeaveCriticalSection
EnterCriticalSection
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
TerminateProcess
GetCurrentProcess
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapReAlloc
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
GetStringTypeW
user32
MessageBoxW
Sections
.text Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 560B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 796B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ