Behavioral task
behavioral1
Sample
fedbf1d9e155cdb63a320fb2a0bad759a0cf7d7273274a75b5190741e6d2ce1b.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
fedbf1d9e155cdb63a320fb2a0bad759a0cf7d7273274a75b5190741e6d2ce1b.exe
Resource
win10v2004-20240802-en
General
-
Target
fedbf1d9e155cdb63a320fb2a0bad759a0cf7d7273274a75b5190741e6d2ce1b
-
Size
4.8MB
-
MD5
5aebb21fa90c4dc08a0b27ae1f1a5a27
-
SHA1
69efd938c9102e8d927b23720f59c0e70fceb802
-
SHA256
fedbf1d9e155cdb63a320fb2a0bad759a0cf7d7273274a75b5190741e6d2ce1b
-
SHA512
3e28cef84ff4fca3e9e1f98757fc4fc24e93c43c5328689bf785ac58ea971d7500ee0b3c6cb441f9d119e42ecbe85a937860247079a0e092b1454fae5ede45ea
-
SSDEEP
98304:1iXSMXam3CKb4pbahzeOPzJky/cK28yomMtB6a2SWYZxFpp0/FvyYkiFD1MDVbYW:kXX3SS2mgmsKFm7AWYfFP8x3ZOYLteB
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fedbf1d9e155cdb63a320fb2a0bad759a0cf7d7273274a75b5190741e6d2ce1b
Files
-
fedbf1d9e155cdb63a320fb2a0bad759a0cf7d7273274a75b5190741e6d2ce1b.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 164KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 4.6MB - Virtual size: 4.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 200KB - Virtual size: 199KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ