Behavioral task
behavioral1
Sample
b1c98299f5f86b3c862642666b08967772f7928029ab9d6e1724da72f1f94f72.dll
Resource
win7-20240729-en
General
-
Target
b1c98299f5f86b3c862642666b08967772f7928029ab9d6e1724da72f1f94f72
-
Size
782KB
-
MD5
66a962b8a98994c38b7c4e3cbc89bd89
-
SHA1
4494e2a31ba3e8377c487192864e2a489ad39a20
-
SHA256
b1c98299f5f86b3c862642666b08967772f7928029ab9d6e1724da72f1f94f72
-
SHA512
e7eba3b285b4fd01672004b459049bc6a0366bbc749f00d20009a64bc901687f62d2a045f852dd5b67641b60e0a7e5d83f39c15408dfd098eaf9746324f2a286
-
SSDEEP
24576:VA2oHm3zxXJs8AV/FWftMtvRH/hB4WhRmL:0HmDxXJfm/otMtvd/74Wb
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b1c98299f5f86b3c862642666b08967772f7928029ab9d6e1724da72f1f94f72
Files
-
b1c98299f5f86b3c862642666b08967772f7928029ab9d6e1724da72f1f94f72.dll windows:4 windows x86 arch:x86
dbe75025ea2e7e1e86420237a101f0e4
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetVersionExA
GetVersion
GetVersionExA
GetVersion
ExitThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
IntersectRect
advapi32
RegQueryValueExA
oleaut32
SysFreeString
version
VerQueryValueA
gdi32
IntersectClipRect
ole32
IsEqualGUID
comctl32
ImageList_ReplaceIcon
shell32
SHGetFileInfoA
wininet
DeleteUrlCacheEntry
urlmon
URLDownloadToFileW
wsock32
bind
ntdll
NtTerminateProcess
iphlpapi
GetExtendedTcpTable
oleacc
AccessibleObjectFromPoint
gdiplus
GdipDeleteGraphics
imagehlp
MapFileAndCheckSumA
atl
AtlAxGetControl
ws2_32
WSAIoctl
Sections
CODE Size: - Virtual size: 781KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 103KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 14KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 97KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 774KB - Virtual size: 774KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 132B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ