Behavioral task
behavioral1
Sample
2c1305008c329cc3bd09e5e03ade7131b0339cf37f606edab6feafaa76610fb8N.exe
Resource
win7-20240903-en
General
-
Target
2c1305008c329cc3bd09e5e03ade7131b0339cf37f606edab6feafaa76610fb8N
-
Size
2.0MB
-
MD5
d34c795a44b0d8a91ddc6123f4083050
-
SHA1
cd7d7e9551ffe92329a42b0d36a55286158644cf
-
SHA256
2c1305008c329cc3bd09e5e03ade7131b0339cf37f606edab6feafaa76610fb8
-
SHA512
7891b47632c90434f3ae2694f361b89c70dccc819fd23248915001e93c4150b7f5c4d27c6c0bfc7a8477a35c1631528e21be94b03c866029aa9212ba3e17e79f
-
SSDEEP
49152:86uglZuXo25xbhUAxs6UqNZB+Km7DPYS/qRpT8:8OZuXoYVhfu3qLBi/Mb8
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2c1305008c329cc3bd09e5e03ade7131b0339cf37f606edab6feafaa76610fb8N
Files
-
2c1305008c329cc3bd09e5e03ade7131b0339cf37f606edab6feafaa76610fb8N.exe windows:5 windows x86 arch:x86
d4229f01e5a129c303cd65de772b5a24
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutOpen
ws2_32
WSAAsyncSelect
rasapi32
RasHangUpA
kernel32
LeaveCriticalSection
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetCursorPos
gdi32
GetWindowOrgEx
winspool.drv
OpenPrinterA
advapi32
RegCloseKey
shell32
DragQueryFileA
ole32
CLSIDFromString
oleaut32
RegisterTypeLi
comctl32
ImageList_Destroy
wininet
InternetCloseHandle
comdlg32
GetOpenFileNameA
Sections
.text Size: - Virtual size: 680KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 908KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 247KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 961KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ