Behavioral task
behavioral1
Sample
5bba0c56dbc00c17b6d6f3b9867327ea0a804d56b97b9b7e9d9c149ae1904279.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5bba0c56dbc00c17b6d6f3b9867327ea0a804d56b97b9b7e9d9c149ae1904279.exe
Resource
win10v2004-20240802-en
General
-
Target
5bba0c56dbc00c17b6d6f3b9867327ea0a804d56b97b9b7e9d9c149ae1904279
-
Size
8.9MB
-
MD5
997320a392fd6286875b85b2e26e9ce0
-
SHA1
5a4480395ca4835061a380c27c332bfbb23997b9
-
SHA256
5bba0c56dbc00c17b6d6f3b9867327ea0a804d56b97b9b7e9d9c149ae1904279
-
SHA512
02175f9b2efe0d7f02bf93b2974c6d65d00b6be5bbdbf0fed057155677f2e61d49d996105b806052542d94264a7f179095a6b0ce691f92617b0370bdb156932b
-
SSDEEP
196608:rJd2CkZ/BN9AhDZlemh1MmT5GoMbh4btPkGI+0lr1Vzuw:1d2C+fmFiu1MU2bahINxn
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5bba0c56dbc00c17b6d6f3b9867327ea0a804d56b97b9b7e9d9c149ae1904279
Files
-
5bba0c56dbc00c17b6d6f3b9867327ea0a804d56b97b9b7e9d9c149ae1904279.exe windows:5 windows x86 arch:x86
ec6c3b5d03339ef976f6b5a57bebd551
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
lua5.1
lua_tonumber
htmlayout
HTMLayoutSelectElementsW
version
GetFileVersionInfoSizeA
user32
GetNextDlgGroupItem
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
sqlite30
sqlite3_close
hssl
sslSetIORef
hcrypt
certGetSubjectPublicKeyInfoDER
winmm
PlaySoundA
hcoord
CoordGetPinStatus
dbghelp
SymFunctionTableAccess
kernel32
GetVersionExA
GetVersion
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
gdi32
SetBitmapBits
comdlg32
GetFileTitleA
winspool.drv
ClosePrinter
advapi32
RegEnumValueA
shell32
ShellExecuteA
comctl32
ImageList_DragShowNolock
oledlg
ord8
ole32
CoRevokeClassObject
olepro32
ord253
oleaut32
SetErrorInfo
netapi32
NetWkstaGetInfo
ws2_32
recvfrom
wininet
InternetReadFile
shlwapi
PathFileExistsA
imm32
ImmGetVirtualKey
iphlpapi
GetTcpTable
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 7.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.TEXT Size: - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 755KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 8.2MB - Virtual size: 8.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 728KB - Virtual size: 4.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ