Behavioral task
behavioral1
Sample
aa5ae0c90edeee8a574a7b6e01f62a5e0f135a58203a4af5d3bcbff4ee9b3d8a.exe
Resource
win7-20240903-en
General
-
Target
aa5ae0c90edeee8a574a7b6e01f62a5e0f135a58203a4af5d3bcbff4ee9b3d8a
-
Size
12.2MB
-
MD5
748f4433ea04f43c0b55dc6a6e48a381
-
SHA1
14effd396c0af452bcde1af07b8df777e44ed38d
-
SHA256
aa5ae0c90edeee8a574a7b6e01f62a5e0f135a58203a4af5d3bcbff4ee9b3d8a
-
SHA512
2dd339b0e0d5cadf42e1d3388b4d97777b8e6caef3e4adfc4f3fee68ce818f59dc2edf8a5ad4a1d0e6ad693e579584d566220be56297a44a03d0dec8aa28c710
-
SSDEEP
393216:ORMqb4FolMEDBhu+Zu8euq+UD+/2fJVGdgD9Ho:VO4FqD+F9z+C+/2RRHo
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource aa5ae0c90edeee8a574a7b6e01f62a5e0f135a58203a4af5d3bcbff4ee9b3d8a
Files
-
aa5ae0c90edeee8a574a7b6e01f62a5e0f135a58203a4af5d3bcbff4ee9b3d8a.exe windows:5 windows x86 arch:x86
30cdce7155e88e96196ac27fbf9329cd
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvfw32
DrawDibDraw
avifil32
AVIStreamGetFrame
iphlpapi
GetAdaptersInfo
winmm
waveOutGetNumDevs
ws2_32
send
rasapi32
RasGetConnectStatusA
kernel32
GetVersionExA
GetVersion
lstrcpynA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
IsRectEmpty
gdi32
BeginPath
msimg32
GradientFill
winspool.drv
ClosePrinter
comdlg32
ChooseFontA
advapi32
RegOpenKeyExA
shell32
DragQueryFileA
ole32
OleRun
oleaut32
SafeArrayUnaccessData
comctl32
ImageList_SetBkColor
wininet
InternetCloseHandle
Sections
.text Size: - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 609KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 8.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 12.2MB - Virtual size: 12.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ