Behavioral task
behavioral1
Sample
912aa46b7affd7af4dcdb759bef4de5808f9dbc14a9737aa2d2ce753a2cabc85.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
912aa46b7affd7af4dcdb759bef4de5808f9dbc14a9737aa2d2ce753a2cabc85.exe
Resource
win10v2004-20240802-en
General
-
Target
912aa46b7affd7af4dcdb759bef4de5808f9dbc14a9737aa2d2ce753a2cabc85
-
Size
10.2MB
-
MD5
9e8c96d963aa4d59633fdbc2bbccb021
-
SHA1
364745e94a9da007f801fbaa0694d309a6a5b9e8
-
SHA256
912aa46b7affd7af4dcdb759bef4de5808f9dbc14a9737aa2d2ce753a2cabc85
-
SHA512
7cd0392ca85abc6aa376e257906402b1f70996f5c5371d8839add183c5d21662ab7c132d04b6e3de9804d069a59d782408497664eb6664864e114e8a11001e28
-
SSDEEP
196608:mtI0Iysn7zXrYnwu2kMKCbyafUtxUQv4YKvLmeA6un6MEuKusqgfGLHrLDFOX:mtIjnfrYnwlKVactSYaSeA7nnMqQyfA
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 912aa46b7affd7af4dcdb759bef4de5808f9dbc14a9737aa2d2ce753a2cabc85
Files
-
912aa46b7affd7af4dcdb759bef4de5808f9dbc14a9737aa2d2ce753a2cabc85.exe windows:6 windows x64 arch:x64
675a2ee39883b1d4f53a21812da15b0b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
msvcp140
_Xtime_get_ticks
wininet
HttpOpenRequestA
kernel32
GetSystemTimeAsFileTime
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MapVirtualKeyA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptReleaseContext
shell32
ShellExecuteA
mfc140
ord1750
comctl32
InitCommonControlsEx
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memchr
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-string-l1-1-0
isalnum
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-stdio-l1-1-0
fsetpos
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-math-l1-1-0
atan2f
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 150KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 8.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 10.1MB - Virtual size: 10.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ