Behavioral task
behavioral1
Sample
044e5b5944c00809a3ac25c349630f48583290202627fc6bf3dee08cb3cb3646.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
044e5b5944c00809a3ac25c349630f48583290202627fc6bf3dee08cb3cb3646.dll
Resource
win10v2004-20240704-en
General
-
Target
044e5b5944c00809a3ac25c349630f48583290202627fc6bf3dee08cb3cb3646
-
Size
11.0MB
-
MD5
54f0f6ec5359311337668b73bd3056bd
-
SHA1
9fdf95e5b06167bae04e5a9f2577c96496f2f499
-
SHA256
044e5b5944c00809a3ac25c349630f48583290202627fc6bf3dee08cb3cb3646
-
SHA512
ccaaf733ea28cf9f6d84a77e020acb63f77d193ffe285d07dab628fbba238714624fee43241831e783557b5e3fd05754d45a9989243aea8982e62a2a567b6fcf
-
SSDEEP
196608:QCHcDBI5j6YbCqyA0zd95Cr3Ws1w8vxkn:zHcDBI5jTbCqyAGUrThxkn
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 044e5b5944c00809a3ac25c349630f48583290202627fc6bf3dee08cb3cb3646
Files
-
044e5b5944c00809a3ac25c349630f48583290202627fc6bf3dee08cb3cb3646.dll windows:6 windows x86 arch:x86
8fc96492563fab1a8d60314d36cee16c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
SizeofResource
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
CreateWindowExW
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
CreateDIBSection
gdiplus
GdipDeleteGraphics
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 388KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 8.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 11.0MB - Virtual size: 11.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 233B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ