Behavioral task
behavioral1
Sample
Baldwin_Temp.exe
Resource
win7-20240611-en
General
-
Target
Baldwin_Temp.exe
-
Size
3.1MB
-
MD5
152e450e18ad29fbdade3752a82160be
-
SHA1
f037ff0d3416f469a5714c40a3fe6b95b0864eed
-
SHA256
b7c95763a0d93faa280d8114024406dc4ac311e50ff5791fc3221359f23ed121
-
SHA512
1ba209f99180c90e145fbc059d1c750b4ebe1bf4aa82ea128569f185e2d7398cc0e797853a1b5521a6acf1c5cfd048a0b2ec7effe75845e381938a05249ef97d
-
SSDEEP
98304:fCnQQL2x5U7Obb7aLDzFPIT4bNJFY3Oqt:f1ZxoObozljBHY
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Baldwin_Temp.exe
Files
-
Baldwin_Temp.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 159KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 3.0MB - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ