Behavioral task
behavioral1
Sample
ceae6575498c335efde2f72917cbb54417e964554333c015a72d45d60cb2097e.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ceae6575498c335efde2f72917cbb54417e964554333c015a72d45d60cb2097e.exe
Resource
win10v2004-20240802-en
General
-
Target
ceae6575498c335efde2f72917cbb54417e964554333c015a72d45d60cb2097e
-
Size
736KB
-
MD5
837c3fe05ccc4e88a8d18c1ec4fc39cf
-
SHA1
6edfdbadc4f7fa8c475f3f40ac86b2308f7f1fbf
-
SHA256
ceae6575498c335efde2f72917cbb54417e964554333c015a72d45d60cb2097e
-
SHA512
d830ed440d8331ab9eb1905c6dae5331a4d34fe03317329e7b11da7ee87387b91e530d6c439a4359ae0067157adce99386848531089d1ce67752c30bb666c6d6
-
SSDEEP
12288:B+U3RLVduuRNiJJArONHBNiC1hEbCxMkQB/3FrDfz6783KRLFPh17poJ:B+WLWu0wOnskyZ3Fr/639tFo
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ceae6575498c335efde2f72917cbb54417e964554333c015a72d45d60cb2097e
Files
-
ceae6575498c335efde2f72917cbb54417e964554333c015a72d45d60cb2097e.exe windows:5 windows x64 arch:x64
58e0a471a1359c889a72bdc4e201c677
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
RtlVirtualUnwind
kernel32
MultiByteToWideChar
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
DefWindowProcW
Sections
.text Size: - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 705KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 735KB - Virtual size: 734KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 36B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ