getcc
Behavioral task
behavioral1
Sample
79846b3471e0e946f896c8b52204bf10N.dll
Resource
win7-20240704-en
General
-
Target
79846b3471e0e946f896c8b52204bf10N.exe
-
Size
276KB
-
MD5
79846b3471e0e946f896c8b52204bf10
-
SHA1
93b6e7a12cf8b90b7e031ffb25b9f9bfb955a11f
-
SHA256
1a0f2e44b09625e8026e780301b4099f3604350b776190cc88d354948867061d
-
SHA512
3a0f11f1539865fabfdd1f4c6f638cfafb3a5719e4500ff82fb9db776b5ba9d373d509e3cd93252f2b222ff71c95e5a03af67fccb5812440ba580236d0764533
-
SSDEEP
6144:uvAFkCvORWkJ2wuKv/KajLXt+Dbcg79nNzeU9N3qhIbtzV:aRJ2wuCC2LXtycszD60
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 79846b3471e0e946f896c8b52204bf10N.exe
Files
-
79846b3471e0e946f896c8b52204bf10N.exe.dll windows:4 windows x86 arch:x86
a73ba0f9096816deee8ad87e57a3925d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetStringTypeW
LoadLibraryA
VirtualProtect
GetModuleFileNameA
setupapi
SetupDiEnumDeviceInterfaces
hid
HidD_GetPreparsedData
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 198KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 268KB - Virtual size: 267KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 156B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ