Behavioral task
behavioral1
Sample
83854676fea064dd204226b1aba37f02a3077c2b364870d975e1787f59e8087d.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
83854676fea064dd204226b1aba37f02a3077c2b364870d975e1787f59e8087d.exe
Resource
win10v2004-20240226-en
General
-
Target
83854676fea064dd204226b1aba37f02a3077c2b364870d975e1787f59e8087d
-
Size
13.5MB
-
MD5
b19638c62817c897e0750d4dd6650a00
-
SHA1
28b88e8865871a8ac1fa2d7934d15ef426c921f7
-
SHA256
83854676fea064dd204226b1aba37f02a3077c2b364870d975e1787f59e8087d
-
SHA512
bbdf6c643de517f0e18c3653b0ed2d31ff5f2c27a478a52bb3fc14f741b90319e20f4e1659850eb52c30f0707439ea825eeaef22e574c3f624d5d1281e3b71e5
-
SSDEEP
196608:P+IFFn5BpW3MEEP851Wf4I2fx6YhTJNzHDB0m3GfAWg18TI+6rmw:PRFjycrlVY1TzHDB0GGfLg1Rrm
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 83854676fea064dd204226b1aba37f02a3077c2b364870d975e1787f59e8087d
Files
-
83854676fea064dd204226b1aba37f02a3077c2b364870d975e1787f59e8087d.exe windows:5 windows x86 arch:x86
7bae1c781b4f59b677971df48161ea89
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamClose
ws2_32
recv
kernel32
GetVersionExA
GetVersion
HeapCreate
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetScrollPos
gdi32
CreateCompatibleDC
winspool.drv
ClosePrinter
comdlg32
GetFileTitleA
advapi32
RegOpenKeyA
shell32
ShellExecuteA
ole32
OleRun
oleaut32
SafeArrayGetElement
comctl32
ord17
Sections
.text Size: - Virtual size: 934KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 11.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 394KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xw Size: - Virtual size: 1011KB
IMAGE_SCN_MEM_EXECUTE
.vmp1 Size: - Virtual size: 805KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 13.5MB - Virtual size: 13.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 48KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ