Behavioral task
behavioral1
Sample
9814f620a06f0faacbad2b0ba327af1d6fdfa2b2bde8980cc1175b1923456665.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
9814f620a06f0faacbad2b0ba327af1d6fdfa2b2bde8980cc1175b1923456665.exe
Resource
win10v2004-20240802-en
General
-
Target
9814f620a06f0faacbad2b0ba327af1d6fdfa2b2bde8980cc1175b1923456665
-
Size
4.1MB
-
MD5
6d5dbdb729d601eb26514898dc2a9f75
-
SHA1
8690f3ae2067d5354d428c890e6e91cf5becb1d6
-
SHA256
9814f620a06f0faacbad2b0ba327af1d6fdfa2b2bde8980cc1175b1923456665
-
SHA512
bd9163cab7cd823ece0b98e23894f07a18a7235036f759e0522a3441f9213032e06061d1200c613362ba5ae27b5dbe2cb259212784009b84a6d3f28c92112a99
-
SSDEEP
98304:8tEuwjs7cKe+k9YMYFFYqcb9iVsoF8BGsmr0lL:8GHs7HJJFuN8Vs7BGY
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9814f620a06f0faacbad2b0ba327af1d6fdfa2b2bde8980cc1175b1923456665
Files
-
9814f620a06f0faacbad2b0ba327af1d6fdfa2b2bde8980cc1175b1923456665.exe windows:6 windows x86 arch:x86
be50d00b9b405016001e807d1103c854
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetCurrentDirectoryW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetTimer
MessageBoxW
advapi32
CloseServiceHandle
shell32
Shell_NotifyIconW
ole32
CoSetProxyBlanket
oleaut32
GetErrorInfo
msvcp120
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
iphlpapi
GetAdaptersInfo
libcurl
curl_slist_append
libeay32
ord1654
ssleay32
ord180
everything32
Everything_QueryW
duilib
?SetInternVisible@CEditUI@DuiLib@@UAEX_N@Z
libcef
cef_create_new_temp_directory
msvcr120
?what@exception@std@@UBEPBDXZ
shlwapi
PathIsDirectoryA
crypt32
CryptMsgClose
wtsapi32
WTSQueryUserToken
userenv
CreateEnvironmentBlock
dxgi
CreateDXGIFactory
dbghelp
StackWalk
Sections
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 233KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 33KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 85KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 4.1MB - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 152B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ