Behavioral task
behavioral1
Sample
c8cb9b7ca711561d8745e619683baa7dc6c59077395c1448c910ad91f172ca85.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
c8cb9b7ca711561d8745e619683baa7dc6c59077395c1448c910ad91f172ca85.dll
Resource
win10v2004-20240802-en
General
-
Target
c8cb9b7ca711561d8745e619683baa7dc6c59077395c1448c910ad91f172ca85
-
Size
376KB
-
MD5
db4bac75547fa2572727b9c50a5a5eb1
-
SHA1
4230f2c6ab1d668b295b3ce5d89a3a7e35226e16
-
SHA256
c8cb9b7ca711561d8745e619683baa7dc6c59077395c1448c910ad91f172ca85
-
SHA512
158e17dcff76833ab4df9a7669629aeed3e7d1a630a6240c2a14ba3cbcfeb8afacead7eafbe9b05d8d5888511107522b9725808bfe567f58475acbe166191d89
-
SSDEEP
6144:/AaU6Qe5zZBdXIAyH9yIgdR2HEhTYkf+w9XnokzOjxs/17pcX1fi3qPy/BYP:/AaUDehdXL29yzAklYkmw9XokzOjW/1j
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c8cb9b7ca711561d8745e619683baa7dc6c59077395c1448c910ad91f172ca85
Files
-
c8cb9b7ca711561d8745e619683baa7dc6c59077395c1448c910ad91f172ca85.dll windows:4 windows x86 arch:x86
1b5710e6a853e412dbe14cd7bca64da2
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetTickCount
WideCharToMultiByte
MultiByteToWideChar
IsBadReadPtr
OutputDebugStringA
CloseHandle
ReadFile
GetFileSize
CreateFileA
Sleep
GetLastError
GetModuleFileNameA
DisableThreadLibraryCalls
FlushFileBuffers
SetStdHandle
LCMapStringW
LCMapStringA
LoadLibraryA
GetOEMCP
GetACP
GetCPInfo
RtlUnwind
HeapAlloc
HeapReAlloc
HeapFree
GetCommandLineA
GetVersion
GetProcAddress
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
InterlockedDecrement
InterlockedIncrement
SetFilePointer
GetStringTypeA
GetStringTypeW
user32
KillTimer
SetTimer
GetAsyncKeyState
Sections
.text Size: 36KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 304KB - Virtual size: 300KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ