Behavioral task
behavioral1
Sample
0fb0019a74304771e145e5679ba999c8ef76dd166487be9c4e972251b5fe311f.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
0fb0019a74304771e145e5679ba999c8ef76dd166487be9c4e972251b5fe311f.dll
Resource
win10v2004-20240802-en
General
-
Target
0fb0019a74304771e145e5679ba999c8ef76dd166487be9c4e972251b5fe311f
-
Size
362KB
-
MD5
f45e580970d4fc3b18b6755ae24eec47
-
SHA1
b9438886267ef54e612550dba19102acbef02bed
-
SHA256
0fb0019a74304771e145e5679ba999c8ef76dd166487be9c4e972251b5fe311f
-
SHA512
a732298e23fe42021be716fa51eb3609037472f18eaf6144b0482d7a1d9dd687862c5dfc188377062c48159d3aa0b3234a49625a3d0ceb9620ed8eeaeefe4590
-
SSDEEP
6144:LbiPSoPkcbVkNZroLxiSSmeJTupRQRPXaykB0FzLrBKiGlwDfsVXpl+d:L+PSoPkeeT7fpSpwtLFzL0qUJf8
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0fb0019a74304771e145e5679ba999c8ef76dd166487be9c4e972251b5fe311f
Files
-
0fb0019a74304771e145e5679ba999c8ef76dd166487be9c4e972251b5fe311f.dll windows:5 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Sections
.text Size: - Virtual size: 300KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 103KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 359KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 541KB - Virtual size: 541KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 434B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ