Behavioral task
behavioral1
Sample
2139512e5c44a65f01febd080c9086a0N.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2139512e5c44a65f01febd080c9086a0N.dll
Resource
win10v2004-20240709-en
General
-
Target
2139512e5c44a65f01febd080c9086a0N.exe
-
Size
156KB
-
MD5
2139512e5c44a65f01febd080c9086a0
-
SHA1
5d71e4f20aefa0cb442fd66acc7129ea6b4f7813
-
SHA256
ffa757ac82e7373bb185681abd63fb268e9d8667000d7b1c845a03fc1fb18c83
-
SHA512
3a8f072149273d0c56a1dd49c603139f7e848230ea51c505a1612758315e600f444df614af283f7ece28d7ee6b3dea18cfe253f262eb131e672aa4f057c1afad
-
SSDEEP
3072:/UpcSKyRj+o91NRPz6N+TBflnno/yBIUeOjT4U7j8Ap:MiXI/1NRr6N+TBXIAjT42jL
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2139512e5c44a65f01febd080c9086a0N.exe
Files
-
2139512e5c44a65f01febd080c9086a0N.exe.dll windows:4 windows x86 arch:x86
afe929a2bc6373a2c3c3525a9976770c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
VirtualAlloc
CloseHandle
VirtualProtectEx
OpenProcess
GetCurrentProcessId
GetModuleHandleA
VirtualProtect
GetLastError
GetFileAttributesA
Process32Next
Process32First
CreateToolhelp32Snapshot
CreateProcessA
Sleep
FindNextFileA
FindClose
FindFirstFileA
VirtualFree
LoadLibraryA
GetFileSize
GetLocalTime
FileTimeToSystemTime
GetFileTime
CreateFileA
HeapFree
HeapAlloc
GetProcessHeap
OutputDebugStringA
CreateThread
DeleteFileA
WriteFile
CreateMutexA
GetComputerNameA
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetProcAddress
WriteConsoleA
GetConsoleCursorInfo
SetConsoleCursorInfo
SetConsoleWindowInfo
FreeConsole
AllocConsole
SetConsoleTitleA
GetStdHandle
GetConsoleScreenBufferInfo
ReadFile
SetConsoleTextAttribute
SetStdHandle
GetOEMCP
GetACP
GetStringTypeW
GetStringTypeA
FlushFileBuffers
LCMapStringW
LCMapStringA
MultiByteToWideChar
SetFilePointer
InterlockedDecrement
InterlockedIncrement
GetTimeZoneInformation
GetSystemTime
RtlUnwind
GetCommandLineA
GetVersion
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
WideCharToMultiByte
TerminateProcess
GetCurrentProcess
HeapReAlloc
HeapSize
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetCPInfo
user32
ReleaseDC
wsprintfA
gdi32
CreateCompatibleDC
GetDeviceCaps
CreateCompatibleBitmap
SelectObject
BitBlt
GetStockObject
SelectPalette
RealizePalette
GetDIBits
DeleteDC
CreateDCA
shell32
SHGetSpecialFolderPathA
urlmon
URLDownloadToFileA
ws2_32
send
closesocket
socket
htons
connect
inet_addr
recv
WSAStartup
WSACleanup
shlwapi
PathFindFileNameA
Sections
.text Size: 56KB - Virtual size: 54KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 160B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 48KB - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ