Behavioral task
behavioral1
Sample
c814be7bbc85cf1d82f9487b4f87b34efc3c20446916caad1d3814399fb1ee7b.exe
Resource
win7-20240903-en
General
-
Target
c814be7bbc85cf1d82f9487b4f87b34efc3c20446916caad1d3814399fb1ee7b
-
Size
14.4MB
-
MD5
08030f2cab5f0887a52bef90b7927e09
-
SHA1
b1b6aeca0c555235b7708a8c48fccf6a652cf85c
-
SHA256
c814be7bbc85cf1d82f9487b4f87b34efc3c20446916caad1d3814399fb1ee7b
-
SHA512
4bfc5e5e08023668213360adaeffd337fc9a14f6181de002357f413c94f685909eb414430471625f487b2c83d378aa43a4f23aca50206b760cd64adfa5746a49
-
SSDEEP
196608:RxFDbAlb4HaUYNLfHpO4s3wOB2aRKbH9qZ8h6iMI49UrrPXH/b:7FDMeYp6TRKbGmrjrD/b
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c814be7bbc85cf1d82f9487b4f87b34efc3c20446916caad1d3814399fb1ee7b
Files
-
c814be7bbc85cf1d82f9487b4f87b34efc3c20446916caad1d3814399fb1ee7b.exe windows:5 windows x86 arch:x86
1c7f26d804ccea8a6d535ca619010028
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersion
GetVersionExA
GetVersionExA
GetVersion
ExitProcess
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetMenuCheckMarkDimensions
gdi32
SelectObject
gdiplus
GdipLoadImageFromStream
ole32
CLSIDFromString
imm32
ImmReleaseContext
shell32
ShellExecuteA
shlwapi
PathFileExistsA
winmm
midiStreamClose
rpcrt4
UuidToStringA
winspool.drv
ClosePrinter
advapi32
RegDeleteKeyA
oleaut32
RegisterTypeLi
comctl32
ImageList_Destroy
ws2_32
getpeername
comdlg32
GetFileTitleA
Sections
.text Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10.1MB - Virtual size: 10.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 380KB - Virtual size: 455KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 168KB - Virtual size: 164KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ