Static task
static1
Behavioral task
behavioral1
Sample
30877e4c8961076c1b53cc5afc431b42ba827bc453c879f036bb4ffa357ff0fa.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
30877e4c8961076c1b53cc5afc431b42ba827bc453c879f036bb4ffa357ff0fa.exe
Resource
win10v2004-20240226-en
General
-
Target
30877e4c8961076c1b53cc5afc431b42ba827bc453c879f036bb4ffa357ff0fa
-
Size
10.0MB
-
MD5
433aa0e52a84531200b71a11de2b1dda
-
SHA1
52dfab769392af0d364f187ff7baac81e383ac9f
-
SHA256
30877e4c8961076c1b53cc5afc431b42ba827bc453c879f036bb4ffa357ff0fa
-
SHA512
583cada244c8d793d3075a415cffc4a4738ee73336e0f46fcb8f4c8f73b9140cf3fee577ffe522162354f07e28dd92794def4d4a89ca01302596b4d6b34071e0
-
SSDEEP
98304:ZGnVuriFp3qkN4U+ywC8eP0w86g2GIbGTjnG:UnXplDB8B25iTjG
Malware Config
Signatures
-
Detects executables packed with VMProtect. 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_VMProtect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 30877e4c8961076c1b53cc5afc431b42ba827bc453c879f036bb4ffa357ff0fa
Files
-
30877e4c8961076c1b53cc5afc431b42ba827bc453c879f036bb4ffa357ff0fa.exe windows:5 windows x86 arch:x86
0b9338b9562c4b0faee7417fba6636f0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameW
GetModuleHandleW
Sleep
GetLastError
MoveFileW
GetSystemTimeAsFileTime
DeleteFileW
lstrcpyW
lstrlenW
GetEnvironmentVariableW
lstrcmpA
lstrlenA
UnmapViewOfFile
VirtualAlloc
VirtualFree
GetModuleHandleA
VirtualProtect
SetLastError
LoadLibraryA
LoadLibraryExA
lstrcatA
lstrcpyA
GetModuleFileNameA
GetProcAddress
HeapFree
FreeLibrary
HeapAlloc
GetProcessHeap
LoadLibraryW
LoadLibraryExW
lstrcatW
ReadFile
SetFilePointer
ExitProcess
FormatMessageA
GetCurrentProcess
MapViewOfFileEx
CloseHandle
MapViewOfFile
CreateFileMappingW
SetEnvironmentVariableW
GetFileSize
CreateFileW
WideCharToMultiByte
lstrcpynW
user32
MessageBoxA
wsprintfW
ntdll
LdrLoadDll
NtProtectVirtualMemory
LdrGetProcedureAddress
Sections
.text Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.res Size: 450KB - Virtual size: 452KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ