Behavioral task
behavioral1
Sample
148d272f2a6f22c268b6f1f22a55a8333b184e081870b3b29f819b889bae6a1bN.exe
Resource
win7-20240708-en
General
-
Target
148d272f2a6f22c268b6f1f22a55a8333b184e081870b3b29f819b889bae6a1bN
-
Size
9.9MB
-
MD5
da4c136071d937d10681a5f77d252540
-
SHA1
d743a3fe6d836ce875e8677c96942f88d52dd5d2
-
SHA256
148d272f2a6f22c268b6f1f22a55a8333b184e081870b3b29f819b889bae6a1b
-
SHA512
b83f2b1d51f6c6d11690b36b859fa2ca0b8f676c86cc0b712667a744067c368893f5d6d98379963f53af8113c339eca12da8794a9edf866630fe556d8a52ec2e
-
SSDEEP
196608:IShvUFNWXDG3uFW6h28L0g/mflY8O0QxigZytrjVcei6LLpa+5QIMxQhpO8dJGoo:IS9qWTG3sW6hxBuFYdgVhVfS1SjVYG1s
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 148d272f2a6f22c268b6f1f22a55a8333b184e081870b3b29f819b889bae6a1bN
Files
-
148d272f2a6f22c268b6f1f22a55a8333b184e081870b3b29f819b889bae6a1bN.exe windows:5 windows x86 arch:x86
3eed5a20ac960eea44dfb7d92ec43904
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetSystemTime
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
crypt32
CryptStringToBinaryA
user32
KillTimer
iphlpapi
GetAdaptersInfo
winmm
waveOutGetNumDevs
ws2_32
htons
version
GetFileVersionInfoA
rasapi32
RasHangUpA
gdi32
CreateFontIndirectA
msimg32
GradientFill
winspool.drv
DocumentPropertiesA
advapi32
RegCloseKey
shell32
ShellExecuteA
ole32
OleUninitialize
oleaut32
SafeArrayGetElement
odbc32
ord17
comctl32
ImageList_Draw
wininet
InternetCloseHandle
comdlg32
ChooseFontA
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 9.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 633KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 9.8MB - Virtual size: 9.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ