Behavioral task
behavioral1
Sample
952f56ea1438ec93b4877480602d60f7d2d8bfa677a09a19408fa82fa163fcfd.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
952f56ea1438ec93b4877480602d60f7d2d8bfa677a09a19408fa82fa163fcfd.exe
Resource
win10v2004-20240802-en
General
-
Target
952f56ea1438ec93b4877480602d60f7d2d8bfa677a09a19408fa82fa163fcfd
-
Size
6.7MB
-
MD5
94c140ce22f30d7c5a59fdaea186871f
-
SHA1
2d74b592423c429f0235cb819210d20bfc940970
-
SHA256
952f56ea1438ec93b4877480602d60f7d2d8bfa677a09a19408fa82fa163fcfd
-
SHA512
4f1fe235797ec96b9476ba4f1388af344f02e8f0d2a831bb25cec5cbedff6aed4c60973650218340b834e31ddbd1dd7f865cf1886027dd2f5191b5502cc0c2a3
-
SSDEEP
98304:sNsbMMl36s5uSN685wxxTnqFdCV8RY09+HAxxq9HQtmfxAylb0d21wKOog49pZdv:swTV5VG5qlzi2GxAylb0KwKGiZdv
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 952f56ea1438ec93b4877480602d60f7d2d8bfa677a09a19408fa82fa163fcfd
Files
-
952f56ea1438ec93b4877480602d60f7d2d8bfa677a09a19408fa82fa163fcfd.exe windows:5 windows x86 arch:x86
7ba4232cc9d9fea3c5858f9b93d77ab5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamOut
ws2_32
WSACleanup
kernel32
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
PeekMessageA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
ExtSelectClipRgn
winspool.drv
OpenPrinterA
advapi32
RegQueryValueExA
shell32
ShellExecuteA
ole32
CLSIDFromProgID
oleaut32
UnRegisterTypeLi
comctl32
ImageList_GetImageCount
comdlg32
ChooseColorA
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 955KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 369KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.nx Size: - Virtual size: 2.6MB
IMAGE_SCN_MEM_EXECUTE
.vmp1 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 6.6MB - Virtual size: 6.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ