Behavioral task
behavioral1
Sample
ed3ae28adf86ca6aeed63cac1475d8ae209d3a2827873bb1dd3446e2b84fba1c.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ed3ae28adf86ca6aeed63cac1475d8ae209d3a2827873bb1dd3446e2b84fba1c.exe
Resource
win10v2004-20240802-en
General
-
Target
ed3ae28adf86ca6aeed63cac1475d8ae209d3a2827873bb1dd3446e2b84fba1c
-
Size
7.7MB
-
MD5
4d6054aef43db87a1b3b58ccb8647f1e
-
SHA1
e1959ed1e0a7cdc46b1787a10e8846b9f8d462e8
-
SHA256
ed3ae28adf86ca6aeed63cac1475d8ae209d3a2827873bb1dd3446e2b84fba1c
-
SHA512
e5c9d314e9eca6cb2099bde8764f86955c753e30b7b8aa7823d7b508656517f69a261d988b74cf37626b432aa6a3b2775e54f0d94051639cb25abc2c37b687f0
-
SSDEEP
196608:laMW/YOwInaBywuR2cjGmGKXzpjhMz+MWr0Tj1hSvuz8:SYDIgyDR2cj1GSezWr0TjbSvuz
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ed3ae28adf86ca6aeed63cac1475d8ae209d3a2827873bb1dd3446e2b84fba1c
Files
-
ed3ae28adf86ca6aeed63cac1475d8ae209d3a2827873bb1dd3446e2b84fba1c.exe windows:5 windows x86 arch:x86
f834b53ff9262a2c071f13213bed3256
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamOut
ws2_32
socket
rasapi32
RasHangUpA
kernel32
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
KillTimer
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetViewportExtEx
winspool.drv
OpenPrinterA
advapi32
RegOpenKeyExA
shell32
SHGetSpecialFolderPathA
ole32
CLSIDFromProgID
oleaut32
UnRegisterTypeLi
comctl32
ord17
wininet
FtpGetFileA
comdlg32
ChooseColorA
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 350KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 413KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 7.7MB - Virtual size: 7.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ