Behavioral task
behavioral1
Sample
u2.exe
Resource
win7-20240708-en
General
-
Target
u2.exe.vir
-
Size
3.9MB
-
MD5
e764a104806ac308d01e36ceb93f3460
-
SHA1
1d4727f2cf99963aaeb0114b8c215adc1c509e2e
-
SHA256
47ca292b2b8d1dc59b074c935aa768eb1c84f9f0322183594f4408a234342304
-
SHA512
9ede963ddf2df06d0010da9eb36cc23333b7722037bcfc963d81b34b4e8c90453d67f29d64a2710376c17317bbaed2e7972e0d765ef9c4d450d9b0d4e3fd2352
-
SSDEEP
98304:BDB43CiuYIw9pnfHXQkQejPUyY6XzISNAQfc:NB9QIwDQBeQyY6Mkfc
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource u2.exe.vir
Files
-
u2.exe.vir.exe windows:4 windows x86 arch:x86
85b8f1aff9c3272e9ec824572da09c9a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetEnvironmentStringsW
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
LoadIconA
MessageBoxA
gdi32
GetViewportExtEx
winmm
waveOutUnprepareHeader
winspool.drv
OpenPrinterA
advapi32
RegCloseKey
shell32
ShellExecuteA
ole32
CLSIDFromString
oleaut32
UnRegisterTypeLi
comctl32
ImageList_Destroy
ws2_32
inet_ntoa
comdlg32
ChooseColorA
Sections
.text Size: - Virtual size: 638KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 4.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 247KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 3.9MB - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 128B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ