Behavioral task
behavioral1
Sample
8e3b104baa9f5e7dc0e3ee0905bd30d6028c1458b99c8f5675e8f8049c91d7dd.exe
Resource
win7-20240708-en
General
-
Target
8e3b104baa9f5e7dc0e3ee0905bd30d6028c1458b99c8f5675e8f8049c91d7dd
-
Size
8.1MB
-
MD5
b84b578018aaaf50082c37a58afb7eaa
-
SHA1
6693d2f37f6b9a40d1588ba49553d8438bf08562
-
SHA256
8e3b104baa9f5e7dc0e3ee0905bd30d6028c1458b99c8f5675e8f8049c91d7dd
-
SHA512
dc9b6e1c727f079ca4aecb443a05ee39f7b23bc4a8355cfe190c433010a92c416a7069dc87332ee51455bbaaf9c9453f7db6017df4d4581f6c1828a4f7f8bacd
-
SSDEEP
196608:zZNjOduXKBlz2Im8jTmJAgxAfSpso16Ub7XOnJYZR:zHOdZ2ImcyUSmaJb7+J+
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8e3b104baa9f5e7dc0e3ee0905bd30d6028c1458b99c8f5675e8f8049c91d7dd
Files
-
8e3b104baa9f5e7dc0e3ee0905bd30d6028c1458b99c8f5675e8f8049c91d7dd.exe windows:6 windows x86 arch:x86
bd077599eeb6fa72315d663f0ab170a7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DestroyCursor
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
SetMapperFlags
advapi32
SystemFunction036
shell32
ShellExecuteExA
ole32
RegisterDragDrop
msimg32
AlphaBlend
comctl32
_TrackMouseEvent
shlwapi
PathStripToRootA
uxtheme
GetThemeSysColor
oledlg
ord8
urlmon
URLDownloadToFileA
gdiplus
GdipDisposeImage
winmm
PlaySoundA
wininet
FtpGetFileA
ws2_32
WSAGetLastError
oleacc
LresultFromObject
imm32
ImmGetOpenStatus
winspool.drv
DocumentPropertiesA
oleaut32
VarBstrFromDec
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 603KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 8.1MB - Virtual size: 8.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ