Behavioral task
behavioral1
Sample
5abca2317eb83d7fcebe4f6aff07db67276895b195684f86348d0d64d1e08771.exe
Resource
win7-20240708-en
General
-
Target
5abca2317eb83d7fcebe4f6aff07db67276895b195684f86348d0d64d1e08771
-
Size
310KB
-
MD5
d19fa136085de087372ba99ec91ee195
-
SHA1
3e08e26a98a17ce475dfced3a124015a7fb8cc29
-
SHA256
5abca2317eb83d7fcebe4f6aff07db67276895b195684f86348d0d64d1e08771
-
SHA512
c67ec2da068edb76b34b1f231c4d2cc9773c3edfc7e338e82e3b19d4d2445adf6844c198fdd0febfc6182e9e2e6a37ffcdd9419973241da5fcf522e227c3d6bc
-
SSDEEP
6144:lSrS7G4MioTCL0iKqOdgQbx5chwOY+C9CTe23AyhMFqt5Hya49JYPQh8orlT:KgG46TcKPbx5ch6Me23A4MaIKort
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5abca2317eb83d7fcebe4f6aff07db67276895b195684f86348d0d64d1e08771
Files
-
5abca2317eb83d7fcebe4f6aff07db67276895b195684f86348d0d64d1e08771.exe windows:4 windows x86 arch:x86
1a893f34e74ce17b4dd00a5a491c971d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateThread
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
SendMessageA
MessageBoxA
comctl32
InitCommonControls
wsock32
accept
ws2_32
WSASocketA
Sections
.text Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1008B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 400B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 344B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 254KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 308KB - Virtual size: 307KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 84B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ