Behavioral task
behavioral1
Sample
961f6dd655face5009db2f3d6be82c7a187650062fb82e208d59608e32af2e7c.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
961f6dd655face5009db2f3d6be82c7a187650062fb82e208d59608e32af2e7c.exe
Resource
win10v2004-20240611-en
General
-
Target
961f6dd655face5009db2f3d6be82c7a187650062fb82e208d59608e32af2e7c
-
Size
2.5MB
-
MD5
789c063607eec21891c2f7e72b577c00
-
SHA1
e2817f8711e8f8f7c58e4e669ffb5a2250364bee
-
SHA256
961f6dd655face5009db2f3d6be82c7a187650062fb82e208d59608e32af2e7c
-
SHA512
d9a1fa3beb3da54be748ae017364e0068d9ee84cc417d3a5fcdf3dd45fdf09cd2e48964847d4e275667da937a9c49512196d46ac045c1bac5dde1cb45777d612
-
SSDEEP
49152:Baz+vDWMHdDIDZhJXglmOWHNTdKjWw8oaBIKXIKjreWI6:BZ7WM9iD4WtTdKjWw8vBBrex6
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 961f6dd655face5009db2f3d6be82c7a187650062fb82e208d59608e32af2e7c
Files
-
961f6dd655face5009db2f3d6be82c7a187650062fb82e208d59608e32af2e7c.exe windows:5 windows x86 arch:x86
273b2acc8421ffb917cc62ebece49e16
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutUnprepareHeader
ws2_32
accept
rasapi32
RasHangUpA
kernel32
GetVersionExA
GetVersion
GetModuleFileNameW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
DestroyWindow
gdi32
SetBrushOrgEx
msimg32
GradientFill
winspool.drv
OpenPrinterA
comdlg32
GetOpenFileNameA
advapi32
RegQueryValueExA
shell32
Shell_NotifyIconA
ole32
OleDuplicateData
oleaut32
VarDateFromStr
comctl32
ImageList_Create
wininet
InternetCloseHandle
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 556KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1013KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ