Behavioral task
behavioral1
Sample
7c13f6872c964f6df5678d19de8161129acf7144da7ffe4e5db191b0a4791e25.exe
Resource
win7-20240708-en
General
-
Target
7c13f6872c964f6df5678d19de8161129acf7144da7ffe4e5db191b0a4791e25
-
Size
12.7MB
-
MD5
56eccc54c01c61e8b84ff27211f99781
-
SHA1
d5c4e5b4fa04c684aa150bc133b20bc508e0e0e0
-
SHA256
7c13f6872c964f6df5678d19de8161129acf7144da7ffe4e5db191b0a4791e25
-
SHA512
0c1755d10cc654379a7a7be8fef4e92692b127dee65cdc72f3e0124a71feadbd3c553e7e9ff9b986fe619e2fcc027f80466df8ff4c026cfbd002f6df4eb0d078
-
SSDEEP
196608:+3J2qpo1RM+CREJx5L86AGQWiCFRMQ0c9I8hxGbIssYwjJjsnGHheI0vjmYyZwx:mJ2PLMhREC6shCrzGMV4nWhmDyyx
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7c13f6872c964f6df5678d19de8161129acf7144da7ffe4e5db191b0a4791e25
Files
-
7c13f6872c964f6df5678d19de8161129acf7144da7ffe4e5db191b0a4791e25.exe windows:5 windows x86 arch:x86
4b5e7c68e68d60656b10d805e00f7037
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
UnregisterClassA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetViewportExtEx
winmm
midiOutUnprepareHeader
msimg32
GradientFill
winspool.drv
ClosePrinter
advapi32
RegCreateKeyExA
shell32
SHGetSpecialFolderPathA
ole32
OleUninitialize
oleaut32
UnRegisterTypeLi
comctl32
ImageList_GetIcon
ws2_32
getpeername
comdlg32
GetFileTitleA
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 950KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 278KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 8.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 12.4MB - Virtual size: 12.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 304KB - Virtual size: 300KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
��W��uE Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE