Behavioral task
behavioral1
Sample
vanbypassF.exe
Resource
win7-20240705-en
General
-
Target
vanbypassF.exe.exe
-
Size
3.2MB
-
MD5
6ac786ec0d9a6e3515faa51bfde22b40
-
SHA1
2024c5c4bd59fcbc65a493c0d74ac67baf41bd0d
-
SHA256
bb7c25324b0c1104862ed6526d84d34caf4cdc34a624a4ccca3d20a1d6d45224
-
SHA512
c0dd9f0b6c1e4ecdbbc511a7159c112e7edaed1df56c30e07e98d51ddd059ce340484efdee7c372796423b0f65f96d476f1cf4c41c1250fc54daa334e9983816
-
SSDEEP
98304:fuYR3BBIAK781DFRfgnITn5KOajbU7JOOw/CW2a8:WYRRBj18IT5w3U2/Cz9
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource vanbypassF.exe.exe
Files
-
vanbypassF.exe.exe.exe windows:5 windows x86 arch:x86
23affaf6e57cdc0ba2833666f7916db6
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamOut
ws2_32
WSACleanup
kernel32
GetVersion
GetVersionExA
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
PeekMessageA
CharUpperBuffW
gdi32
PtVisible
winspool.drv
OpenPrinterA
advapi32
RegOpenKeyExA
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
shell32
ShellExecuteA
ole32
CLSIDFromProgID
oleaut32
VariantChangeType
comctl32
ord17
comdlg32
ChooseColorA
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 715KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 376KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 264B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 72KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ