Behavioral task
behavioral1
Sample
443829b2734404ef4b76209089699b1449e0ee444b36784ba11387ba2e3c9a2d.exe
Resource
win7-20240708-en
General
-
Target
443829b2734404ef4b76209089699b1449e0ee444b36784ba11387ba2e3c9a2d
-
Size
12.1MB
-
MD5
8c442dd54a9b1d164dc35837f6ad3571
-
SHA1
9a720164a9a5f8876701917bb6822590c540eb32
-
SHA256
443829b2734404ef4b76209089699b1449e0ee444b36784ba11387ba2e3c9a2d
-
SHA512
3ec4db13006ca1e32f2bc8dd1584f722b451a19b8fab5c2b614694a7f646bbf91823a498042e3743c324d9b323c7522f2f9aaa0f3463a6b15b15748f842c2dc9
-
SSDEEP
393216:WLdmDO9S0Pmo2jN3By53HWcJl/S70cIjITq:6Oj0Pmokk53HWoA7tI0
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 443829b2734404ef4b76209089699b1449e0ee444b36784ba11387ba2e3c9a2d
Files
-
443829b2734404ef4b76209089699b1449e0ee444b36784ba11387ba2e3c9a2d.exe windows:5 windows x86 arch:x86
afae0dbf5fda3c94f50de44beebffd6b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutPrepareHeader
ws2_32
ioctlsocket
kernel32
GetVersionExA
GetVersion
GetFullPathNameA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
ReleaseCapture
gdi32
SetBkMode
winspool.drv
ClosePrinter
advapi32
RegQueryValueA
shell32
ShellExecuteA
ole32
OleRun
oleaut32
SafeArrayGetLBound
comctl32
ord17
comdlg32
GetSaveFileNameA
Sections
.text Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 21.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 428KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 593KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 12.1MB - Virtual size: 12.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ