Behavioral task
behavioral1
Sample
f65c402f88fe2c750a61db22ddcb9094260f01e14e661a2c9fe7e80d81b10e5f.exe
Resource
win7-20240903-en
General
-
Target
f65c402f88fe2c750a61db22ddcb9094260f01e14e661a2c9fe7e80d81b10e5f
-
Size
10.2MB
-
MD5
68e8300404044cb089685cf1719daadf
-
SHA1
d18beed2f6a339ff4c92de8cc417cc4091caa95c
-
SHA256
f65c402f88fe2c750a61db22ddcb9094260f01e14e661a2c9fe7e80d81b10e5f
-
SHA512
ccae601d3879da88f825eb87afe97106a6989f2201b164a8f038a7a30ba85944d044dab6c1b5e4cf69fb38c5506e9dfec1122ed517d17311e406e2ab5d52a5ab
-
SSDEEP
196608:MzVNFlzrttAZFiMKMfMJOi0SxfPKkYUOLtgr:oVfFrtuFxHfMNlK9UZ
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f65c402f88fe2c750a61db22ddcb9094260f01e14e661a2c9fe7e80d81b10e5f
Files
-
f65c402f88fe2c750a61db22ddcb9094260f01e14e661a2c9fe7e80d81b10e5f.exe windows:5 windows x86 arch:x86
cce0672ab821e6670a50aab0c228430a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamOpen
ws2_32
WSAStartup
version
VerQueryValueA
rasapi32
RasGetConnectStatusA
kernel32
GetVersionExA
GetVersion
TerminateThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetClientRect
gdi32
GetClipRgn
winspool.drv
DocumentPropertiesA
advapi32
RegCloseKey
shell32
Shell_NotifyIconA
ole32
CoFreeUnusedLibraries
oleaut32
SysAllocString
comctl32
ImageList_Destroy
oledlg
ord8
wininet
InternetSetOptionA
comdlg32
GetFileTitleA
Sections
.text Size: - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 327KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 9.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 10.2MB - Virtual size: 10.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ