Behavioral task
behavioral1
Sample
b4ec5d4b9ff7f5fdf484cb796232f4e920bb6663eb225f5e9db24c8590479714.exe
Resource
win7-20240708-en
General
-
Target
b4ec5d4b9ff7f5fdf484cb796232f4e920bb6663eb225f5e9db24c8590479714
-
Size
11.9MB
-
MD5
599c0d963c6cfc2f0bc566ba36ec18c6
-
SHA1
36fa3cb379d99c8f418dc7cc4736bcaad2dca4bd
-
SHA256
b4ec5d4b9ff7f5fdf484cb796232f4e920bb6663eb225f5e9db24c8590479714
-
SHA512
ee8bc967f1c35c647cf1ec057858538498635d3e7b6f68ce1cbde43ab5baf8b76982af60df374a3c33cadf430def411227c09fe07069508b7212b78d4d230ab2
-
SSDEEP
196608:zTEBbxMIZw6+Nj8YXHJnHq2b37Qc12dPWDAcKVhx9OYjJSDSa8xdcqOoJqJ/ek:+ZV+NPnLfQzdecJV79OWqfCJRC/
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b4ec5d4b9ff7f5fdf484cb796232f4e920bb6663eb225f5e9db24c8590479714
Files
-
b4ec5d4b9ff7f5fdf484cb796232f4e920bb6663eb225f5e9db24c8590479714.exe windows:5 windows x86 arch:x86
2409eb546a9f327b9888c5ab16d93e95
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvfw32
DrawDibDraw
avifil32
AVIStreamInfoA
winmm
midiOutReset
ws2_32
WSAStartup
kernel32
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetSysColorBrush
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
CreateRectRgn
msimg32
GradientFill
winspool.drv
ClosePrinter
comdlg32
GetFileTitleA
advapi32
RegCreateKeyExA
shell32
ShellExecuteA
ole32
CoTaskMemFree
oleaut32
SafeArrayGetUBound
comctl32
ord17
oledlg
ord8
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 5.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 11.9MB - Virtual size: 11.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ