e:\MiniDownLoad\trunk\MiniXL\pdb\ProductReleaseMiniXL\RemoveLowerVersion.pdb
Behavioral task
behavioral1
Sample
32cf5c8f534d08a97179e4e29274c580N.exe
Resource
win7-20240708-en
General
-
Target
32cf5c8f534d08a97179e4e29274c580N.exe
-
Size
272KB
-
MD5
32cf5c8f534d08a97179e4e29274c580
-
SHA1
87494f04f0005a9ef9c1436878f93b7d3c151557
-
SHA256
9a2f47ecaf81b0a593984222c4030de8337047db4c8f75acbd440777ec0e93be
-
SHA512
fdc97cef9806fef83ee14c88b65ec5f0c5ea9c93ad6a9d5ba4593d8bb35b7dbac5fd83271d11156ddf3526789edca3a3de635d5dc225a0c66aa8e18d8308f624
-
SSDEEP
6144:rDv/qJVVXRbLmusRkZ+m9OuozRyDUs6PjhyfjUHy5P99wuv+ctnFfBbFRy:rDKJVVhWu4pm9OuozRdph6juy59939Fo
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 32cf5c8f534d08a97179e4e29274c580N.exe
Files
-
32cf5c8f534d08a97179e4e29274c580N.exe.exe windows:4 windows x86 arch:x86
5a185831e6d9e0f88cc4ba8da47f30f6
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetVersionExA
GetVersionExW
HeapAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
shell32
SHGetSpecialFolderLocation
ole32
CoTaskMemFree
shlwapi
PathAppendW
version
GetFileVersionInfoW
Exports
Exports
T��T��+x ��#����,A��4!m��Q�L>�_�����IW�Ǖcq�B�(��;,�͎��o�lد��%RҐ��0��O�������.�K+���� ���3% ��JgYD�`���{�Ջy���4�6x#Llb�ԞY�ۼ���^�[������,�\�����ֳ�~�LL�P����4�y��M\aЋK\��6h�Β"gvU���rc�������d�/�P=/O�aq�*�^K�MVNJ�Y��xJ��V�X�������Q@|�J ���j����(0����|<Z��/^����<0vA;;�TW���a����������L��Mjp WH�����h���j� �j�Dy4�l�>܆���]����sCJ�1G�������:��-r��g���S�z�r�����s~�;F��$4�y�����1甆�&x����e4/���q� �&�rT����;��tR�\�d7*ޣ(i��nO�v,����7F�ƅx�ٴ�0���5|������"��[��x���q����IJNz������j�0&��J%A�i�Z'0D��@����E=ʲJlΗ��!�?=���=}ƏV}���9 {�7K8�5T��i�e\�k�i،!�H+u=w�6���0p�s�#a� d��uM*A��rGK��O>�>M�A�a���s�V;��7����;��v[>��@շ��P��t�%�I�zo�ᗁ?%�X�R#�@��#ݞ!�*}�¾�4�K�ż\�ZDΑ,�����:����~y�#fDF������t H��{���[��QWa#���o��PBx� �)�hxO6�OD�@26tg����=S�2�ݜҖ�M��p��3��� s���3'\L9tM����ZS�b�^�[L~�r<����QͿ���:P�-ߗ��I*#��\�a��a�ms"�H;BX� 9ᣎ�g�݈�4[�/_۔�I/x�5�?���@8��+��d�<�5�[)�-�:�����o3^`�Z��p�SI�Q�%��%��&xU�Ֆ��\n_�Mv�#�'>d�)�$ϼ��;~�8��9&�j!�2���4O�168®���Ʃ���β��{/m��x5�)(f�s�稯�T�x!}eo����H�B�G$�$A��C���_� ��C��G�Jz�^E��iL��?�V����#�7v�'YG��jE40��.�5'���_\a�X���">K��|�?���Y� ���L-Dg ����E�h���7Е���}�2�L7�~ I�:<����]k��f�Y����Br���I�zp��+w"�o�B��r��,RL��Y�3 �K�9���S��kJ�Sw�H����N�dty+34�� �d� x�f����>|w��RCB�0E�k+Y�0-KJ]Ķ��W�Ȍ^\{��t���O8,��h�L��Q5[��6YA)THg�el��D['��d���|Lt�5%ρ��^�|<d�gj���(B�C^��!�$>�B�9L�e�eOH����2,����&���F���s`}`��3֥@���Y��P�G^���:L�dČ��*�9�R�x�=\SQ�,*鶴��d���Җn�^*H�`�l;UN��%h+��Y�#&��q�����"�*Ϳ��\�W���E�o���Xrqoz!|��u�&z=ٜ,XP ���bR��.D�\>�4DŽV>�A�^Wj�ԁ�d-]�U�KxԷ<�$Ԁׁ�_�d�.�PĬ�&� � �V.av�?T5c#wF�H-p&���F��EI�8�_=X*kik`c�Rf�P������蒖�$��ngNI.�I���3�Sh�v;7��I�;�#I<��T��շ���Ni��WO�m�[q}�w����J����O����!?�c��o-b�tɣ6�� Bf{���ugI|Ƿ��({�P}WpKȈ͜�e���U8���J�~�A?��������.��o�F�K}��e�B�@>���y���ӷ��������Or�j�������s$k�#(:�u�����!�z��`X��S�P ���Q���寥�p0�љ]�gI��:?�!�Z��\+�!f�k��[)c��J~�G;�a��4��Sy�`�Z=I�8���Y��Y{�m�ok4�� ����=@� �ɯ6A��I��lL��ݜ��ыm��Ot$��$���������<�j�{�ո}q6`<��.�`�Q�&sk�̓ibQ/�|c������`{��rt>�ɝ�5K�f1$PYU��-���d*�Р\��;Ў�n�C����������x���m�L B'_�����Z��v�����p?��z��T;�5�=�����z;a���O%q���h�VB��>���hpa��#f�H-X�q������1����w:��})|A v܄l��^��)bL5�����e ����#|��Ȭ� J"���a���h� �d1�gт�qڏ@��j�����DmT�}:$�ƚf##�7q�Jb|���QA�k�Z{f�ߍ'���3�œB�� �@�T[xi�l�� �@�U�ޤD,O�Ȅ�G��!Gђ�FZi3=�:HW�����m���٧F��d�,R�z�WLwJ���Z�Cv���~���}����Eo��b�5���-� �iJu�c���yh�!25�VG��d�:[����ie��ԉ��k<��/�t4tFi���'"�e��k�s����cY��i�M�.��M7�c�2�9RKS� �Lher�y�>���{t~����|f�v�jh����J��7�A sa,����v��S+W��%�-$���b��Wd��Ѥ��'��j�M)�C����&��F�cd}-���iaR`�ʏc���k�����l�W�t7I��8ճ�b�Wv�9��J4<��Ζ�L� ���0�����o�C���e��~�`K\�O�`Uc�.<>��&��� ���t��;~�שXEߘ$@���ZW�AJp�k��`�E�3�{�%� �i�o]�� �|0���F5���=f�'�q4�^x�N�;�L���M��J���bji��]���|Ďwl�Ȯ�i�jvI�V��o
Sections
.text Size: - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 117KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 260KB - Virtual size: 258KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ