Behavioral task
behavioral1
Sample
aa3a882bfe2683cb68950da9d2821305648c8788050a1b3658babd58a9c0f02a.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
aa3a882bfe2683cb68950da9d2821305648c8788050a1b3658babd58a9c0f02a.exe
Resource
win10v2004-20240611-en
General
-
Target
aa3a882bfe2683cb68950da9d2821305648c8788050a1b3658babd58a9c0f02a
-
Size
2.9MB
-
MD5
cf136abe87d58b66e93a1fe841bcfc52
-
SHA1
08ff27c8d24ddb63f91b328fc121ac6945aa045f
-
SHA256
aa3a882bfe2683cb68950da9d2821305648c8788050a1b3658babd58a9c0f02a
-
SHA512
cc84e8f07279b53024e6a75ced023906ac0b3b562a3210f59e3327761a6dedf9db20c808e14015916a0f496fe25a07399bc65842da1e0647ec93b5a087c6cc31
-
SSDEEP
49152:3E4xzCu5Ei++9CC5RIfiJLZ1zxDAJm49evCI3QAovTdYEYIFxbARZQGnok8uG2J4:UMgasuiaJLX2mQevCSQAkTdEIFq/QInG
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource aa3a882bfe2683cb68950da9d2821305648c8788050a1b3658babd58a9c0f02a
Files
-
aa3a882bfe2683cb68950da9d2821305648c8788050a1b3658babd58a9c0f02a.exe windows:5 windows x86 arch:x86
547bbce8322776854526c3dc580e445d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamOpen
ws2_32
ioctlsocket
kernel32
GetVersionExA
GetVersion
LeaveCriticalSection
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetParent
gdi32
SetViewportExtEx
winspool.drv
OpenPrinterA
advapi32
RegOpenKeyExA
shell32
Shell_NotifyIconA
ole32
CoCreateInstance
oleaut32
SafeArrayGetDim
comctl32
ord17
comdlg32
GetOpenFileNameA
Sections
.text Size: - Virtual size: 745KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 357KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 899KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.9MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ