Behavioral task
behavioral1
Sample
6b2ff281526b5bf657d14bc3300e2f50N.dll
Resource
win7-20240708-en
General
-
Target
6b2ff281526b5bf657d14bc3300e2f50N.exe
-
Size
781KB
-
MD5
6b2ff281526b5bf657d14bc3300e2f50
-
SHA1
f39de7042fc15fc9bd682229cc8c256df5a13601
-
SHA256
aa7a55f534488b92bd72472085f5dda752728175ada10235ed9208e69dade8e7
-
SHA512
c76a482aafdf7740a0b9dc7bdf4528f19d709cdc042b20080ff960eca85da8050ec0c132bd401fb71401cf191cf66f29e8bc176f48c9916100ec493dc2dfcf84
-
SSDEEP
24576:LA2oHm3zxXJs8AV/FWftMtvRH/hB4WhRmL:CHmDxXJfm/otMtvd/74Wb
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6b2ff281526b5bf657d14bc3300e2f50N.exe
Files
-
6b2ff281526b5bf657d14bc3300e2f50N.exe.dll windows:4 windows x86 arch:x86
dbe75025ea2e7e1e86420237a101f0e4
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetVersionExA
GetVersion
GetVersionExA
GetVersion
ExitThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
IntersectRect
advapi32
RegQueryValueExA
oleaut32
SysFreeString
version
VerQueryValueA
gdi32
IntersectClipRect
ole32
IsEqualGUID
comctl32
ImageList_ReplaceIcon
shell32
SHGetFileInfoA
wininet
DeleteUrlCacheEntry
urlmon
URLDownloadToFileW
wsock32
bind
ntdll
NtTerminateProcess
iphlpapi
GetExtendedTcpTable
oleacc
AccessibleObjectFromPoint
gdiplus
GdipDeleteGraphics
imagehlp
MapFileAndCheckSumA
atl
AtlAxGetControl
ws2_32
WSAIoctl
Sections
CODE Size: - Virtual size: 781KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 103KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 14KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 97KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 774KB - Virtual size: 774KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 132B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ