Behavioral task
behavioral1
Sample
00f2ac7dac12ad001dce7f75a0fc38710284126e0837d1a6538905eeebff09f8.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
00f2ac7dac12ad001dce7f75a0fc38710284126e0837d1a6538905eeebff09f8.exe
Resource
win10v2004-20240508-en
General
-
Target
00f2ac7dac12ad001dce7f75a0fc38710284126e0837d1a6538905eeebff09f8
-
Size
6.6MB
-
MD5
269073ac99f8577b3d0fd61a5a32f996
-
SHA1
9c67cede201c93a4a4271a1bd50b2507c7b925c2
-
SHA256
00f2ac7dac12ad001dce7f75a0fc38710284126e0837d1a6538905eeebff09f8
-
SHA512
6b18832d94275c85d646a9d52c5cf2d00ac8c49642ae475df8b75d51a844160ba252d2cb35015e4ab56caeead8b47eb3f09d125a126c5aaf9c935b53110cea39
-
SSDEEP
98304:c5fPT8WQua9yq/qI9Anhl265QA25h5Nx7YzAgGO/WY9/2bZyKlBFxWGwz59vRp2+:EfVW9yO9yeNAGhdYkgXWY6UzDvRpDJ
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 00f2ac7dac12ad001dce7f75a0fc38710284126e0837d1a6538905eeebff09f8
Files
-
00f2ac7dac12ad001dce7f75a0fc38710284126e0837d1a6538905eeebff09f8.exe windows:4 windows x86 arch:x86
331e63bfade65dcf2650fcc5a610fb64
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamOut
ws2_32
bind
rasapi32
RasGetConnectStatusA
kernel32
TlsSetValue
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetRect
gdi32
SetViewportOrgEx
winspool.drv
DocumentPropertiesA
advapi32
RegCreateKeyExA
shell32
ShellExecuteA
ole32
StgCreateDocfileOnILockBytes
oleaut32
SysAllocStringLen
comctl32
ord17
oledlg
ord8
wininet
HttpQueryInfoA
comdlg32
GetOpenFileNameA
Sections
.text Size: - Virtual size: 988KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 457KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.2MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE