Behavioral task
behavioral1
Sample
6c8f4528824e4a61583b2341e4d51c0a588afa41ff27311c5c16435560fbce66.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
6c8f4528824e4a61583b2341e4d51c0a588afa41ff27311c5c16435560fbce66.exe
Resource
win10v2004-20240611-en
General
-
Target
6c8f4528824e4a61583b2341e4d51c0a588afa41ff27311c5c16435560fbce66
-
Size
12.8MB
-
MD5
615f86ba3f973d89d280259324a2997a
-
SHA1
102f8da24fe8f3f47a4a183cad8aab1a492744c3
-
SHA256
6c8f4528824e4a61583b2341e4d51c0a588afa41ff27311c5c16435560fbce66
-
SHA512
c334d85e08dc23c23e4c85156ab4fd68d81b02959d6c4c92223763f747f76d139ba1368e3b71fea2af922197997c423a2b6c84da43144f840cf53276fa8784d0
-
SSDEEP
393216:cPP5QOs7PBbY7OJ7+0hO3tDDK13cm03ga07In:EwmOt5h4xuz03gq
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6c8f4528824e4a61583b2341e4d51c0a588afa41ff27311c5c16435560fbce66
Files
-
6c8f4528824e4a61583b2341e4d51c0a588afa41ff27311c5c16435560fbce66.exe windows:6 windows x86 arch:x86
2a1f424e655cdfce33b9a7e85746dbde
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
libcurl
curl_easy_init
version
VerQueryValueA
kernel32
GetVersionExW
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ExitWindowsEx
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
RegQueryValueExW
shell32
Shell_NotifyIconA
sdl2_image
IMG_Load
sdl2_mixer
Mix_OpenAudio
sdl2_ttf
TTF_Quit
sdl2
SDL_HasClipboardText
libpng32-32
png_init
msvcp120d
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
ws2_32
recv
msvcr120d
_rotl
netapi32
Netbios
dbghelp
MiniDumpWriteDump
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 4.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 119.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 8.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 12.8MB - Virtual size: 12.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ