Behavioral task
behavioral1
Sample
940e28a439f2efb249ac0d0cfc859dd30262c03cb26a71de5d8dd0812d8ca409.dll
Resource
win7-20240903-en
General
-
Target
940e28a439f2efb249ac0d0cfc859dd30262c03cb26a71de5d8dd0812d8ca409
-
Size
136KB
-
MD5
d5338f39a84abf869b555e5eb3fbac0e
-
SHA1
9f31921add19a3a252186863fa657bb6acc77bc7
-
SHA256
940e28a439f2efb249ac0d0cfc859dd30262c03cb26a71de5d8dd0812d8ca409
-
SHA512
be9d3385df9851bc26939e5c9b1c3281d37db44f39fc2eda9c73f4336ca75a589fce12ba9e35e642254f683601676e62d8dcfd83ca90b9e1f29ddee1aa40b6ed
-
SSDEEP
3072:r0ZvsOeuHhD92ojqddmLOS/TfRzkpO4dsSx3D9RpV:rdOeGhD92eG0OSrZgpOKHlDpV
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 940e28a439f2efb249ac0d0cfc859dd30262c03cb26a71de5d8dd0812d8ca409
Files
-
940e28a439f2efb249ac0d0cfc859dd30262c03cb26a71de5d8dd0812d8ca409.dll windows:4 windows x86 arch:x86
cdc1b78651f56245fd6b6156cfc16f71
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetVersionExA
GetVersion
GetStringTypeW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Sections
.text Size: - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 56KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 128KB - Virtual size: 127KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 120B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ