Behavioral task
behavioral1
Sample
ce87da61ae4835b2ab1428583f4c5099eb0df3b818c45ba36c18428b50d40c3d.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
ce87da61ae4835b2ab1428583f4c5099eb0df3b818c45ba36c18428b50d40c3d.exe
Resource
win10v2004-20240704-en
General
-
Target
ce87da61ae4835b2ab1428583f4c5099eb0df3b818c45ba36c18428b50d40c3d
-
Size
5.6MB
-
MD5
d965cea947d37351ca248904b34f7bb7
-
SHA1
4422c436dcd2f98852845bee5910a226a8e1570d
-
SHA256
ce87da61ae4835b2ab1428583f4c5099eb0df3b818c45ba36c18428b50d40c3d
-
SHA512
a65300cc814eacc7593b66394e28e42733dfdcd86bdeb36dfbd53bea74d802f26aa3e28735f0c6ac7087c5a1a403e4093689c691d4f90ecf460da9837fe805d5
-
SSDEEP
98304:w2xeOuOV/TVnOhtUMFMXX6TtaUxonWxk34Fsv3kaIXy38zrPBY12hbwYAWe:w2EOug5nOhtjFIXCtasou5F1ysTuUVT
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ce87da61ae4835b2ab1428583f4c5099eb0df3b818c45ba36c18428b50d40c3d
Files
-
ce87da61ae4835b2ab1428583f4c5099eb0df3b818c45ba36c18428b50d40c3d.exe windows:5 windows x86 arch:x86
44377faa8cdde536b58d8fa4749965b6
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
LoadIconA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetTextMetricsA
winmm
waveOutUnprepareHeader
winspool.drv
OpenPrinterA
advapi32
RegCloseKey
shell32
ShellExecuteA
ole32
CLSIDFromProgID
oleaut32
SafeArrayGetElement
comctl32
ImageList_Destroy
ws2_32
inet_ntoa
comdlg32
ChooseColorA
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 671KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 295KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 60KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ