Behavioral task
behavioral1
Sample
85fcf42e73ccfe059372d5326aafe05e45d2f008d443d8d45c19afeb107a437f.exe
Resource
win7-20240903-en
General
-
Target
85fcf42e73ccfe059372d5326aafe05e45d2f008d443d8d45c19afeb107a437f
-
Size
2.0MB
-
MD5
1f53934b8a5515ed942b826132cc25f8
-
SHA1
4bd111cc7dbef3448b4c5021dd08f6569b2528e3
-
SHA256
85fcf42e73ccfe059372d5326aafe05e45d2f008d443d8d45c19afeb107a437f
-
SHA512
c53f4b58e31905b5e8e654a11da1b05d347c08033e781b6c6b83fa499997016fd9f2461f898dd463c1225333b96d7311ef8d6a9aad5cbc675892aeb59875643d
-
SSDEEP
49152:XGQGbFBDXrr4I26atiF6yTUBBzLWt7fFiE0S9nZPqqo:XZGxBDXrk6a0/4BzLWt7NeSzPqqo
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 85fcf42e73ccfe059372d5326aafe05e45d2f008d443d8d45c19afeb107a437f
Files
-
85fcf42e73ccfe059372d5326aafe05e45d2f008d443d8d45c19afeb107a437f.exe windows:5 windows x86 arch:x86
640068a05d7cf562354abdc4a938773d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamRestart
ws2_32
accept
rasapi32
RasGetConnectStatusA
kernel32
GetVersionExA
GetVersion
GlobalAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetFocus
gdi32
PtVisible
msimg32
GradientFill
winspool.drv
DocumentPropertiesA
advapi32
RegOpenKeyExA
shell32
SHEmptyRecycleBinA
ole32
CLSIDFromString
oleaut32
VariantClear
comctl32
ord17
wininet
InternetOpenA
comdlg32
GetSaveFileNameA
Sections
.text Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 475KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 459KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1000KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 268KB - Virtual size: 266KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ