Behavioral task
behavioral1
Sample
clean_File.bin.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
clean_File.bin.exe
Resource
win11-20240802-en
General
-
Target
clean_File.bin.exe
-
Size
7.8MB
-
MD5
5df6e8e97eccf7e939006d1743a1a0e6
-
SHA1
3a4761b8daad0657aac9a9725d1ac25895019b28
-
SHA256
9b6cd625c94a2113eb8c2ea2aa33d201bce56786f0a7a3f0b11f00865fef9691
-
SHA512
84a2ce3011b93cd5a2954d8d93df76dee6419908241bc699ccfe3e3b19676a1228c93db0647c40de6c4a69b8f1a1c497951898b4ddc214d094d9e58844ace3df
-
SSDEEP
196608:11NYh+Gs1W7QJw19fUxBOVRc6NbUT5zp:11NWs1WsefUsrNUtp
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource clean_File.bin.exe
Files
-
clean_File.bin.exe.exe windows:6 windows x64 arch:x64
a8fd7d4c203686e93829ad2389fb4404
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
�l��/�"�>���_��^�߱�*1�;:�
�����␛�,�"b�3Pݝ
o��̷4"��S��UJ�1hz�lj �?*� ����( �����{K�aR��n���eR�����<a�b؈��V$�z�)�g���u��6b�Og�sD��m5� ���p������)6r�,��A���?�Y�zl�[~�[���z�
]�R|�y�+ק4�~Z�Ϸ,*j3$�����)��o�OF�2�T��ϼ#�
LocalFree
h��ؼV�Ӱ� ��,���rt�rt�T�=�M.pׄK�I+����ʯ������2p�(G>ڏ��RPqC.c������U5d�%S�Ce<pB�l?�ޢ3�}�w�
a@�l�
mN��<��ًhbY��Z&��eMc���K(�� _�4�kYv�Ŕ����&���b��^^vۆJVv'f;����
SetThreadAffinityMask
U��B� ����I�+g��Р�u���U�P�x�"_�E���b|���i&��" ����� ���e %� ޠ�sF����P�~�
ExitProcess
y�����
LoadLibraryA
GetModuleHandleA
8���i��Bv���[v��Dvw� ��q&���6�@v ���]�?��p.sK���?d=v�jѳ����A�$-�2]܌����C����b^̇ ��ce.��^�e��q=�ճij �A����2������vzk��@S���1�D��(aG۱����J�����$�[�.����^(?��W�ym>�8�����pz�F`U���Ni5�Vzk����(�U�᭷�����+�E�
�g l0#���nd�e5kqp_�m�xt`@)&�s��$�cwoj+���xo��߀���x�l�сvs�o�y�x��y��w*�e{(a�����;-f�&j�ɋ^=�ָyȳ�5��gшq4l��v�5�:�йja�������_y�p��/g�:"�3+xʝ�mɇ����g��n�χ0�5+")�v�0*�� շۣ/x%]b(x�p�+��b#��p.���*x_�w�?��/x7n�(�6�+�<z�ԇ���.x1��)xwdi*��&���p�/��ԅ+x�6j^zu|���y�@�5m�>��b���g*jy�
�?o
ˎ"Gndi��>�b��ҮP#�f��A�]�^x�Yl����*;R~|�7�w�^E�؇����ri��H�����Um�(q'_��rv��p`�����a��wXk�]Y[~&��5C�N�*Q@P�~uB�N�:�N����R�߇`���0+�'�ꯜ��;��ur��|b��������yK1(�2�odkģ��~j����NE"~��k�����S�U���B^�z��d�i� \^��# K��N} �袗�y���0L���,��pM�W�<����jy
�g��.B��sC�$�Y+��u.��N
J��D �/�]N8��'#�J�k<�]�����p%� ���ئV�
ę܈�k�j ����d��k�rdw�d2����b�v��}�`;�n� 8��j��;[ 8���1"�n���j����k� q����3vi;s��z�c��6�fl����h%dɝ0�s @h�m��_���m�.��;k.j(���]���yp[t�=w��&�;�{�u��;]�pr4�y��b��{�r�vt���z��h?�kpǚ�utѻ���@��{2c(�;g��\4�����\���{�xttqjf���d��[kecn����
�ݓ�%�:�N݉ �����D����AO2&��j
�p:�"��j�n�m�6�i��gf���i����l<���ըd��t��1th<��]���� �a_�a��iϫ�ei7 9�9f߉y
~�O��be��WZ/P���Y(#)�Kx��e��S��jxm�
v4�\��$ˊ/:�@��8���v�'=:���b���vҋ��k*��;�d��� � �il"�7r�����$�t΅
$ �#:�s�w~;�j�c�v�\a�a�4���ܟ;v�g�i��?��o~��gި��ֺ�g����}c����z���s�m��5x$&�@�g�z�%s3���lj��ҍ�(�
����n.���ᣩ��c'�j�i����a�j���fk���{��y#��f��j���fp� �2�/' `�@a8�$�wpyߴ��>u�ѭa�� ��v2�owu�e�,�~lճy�a��{z�~y0@n����bo��=>g�+���η�ޯ�����lnshn��
���r��<�ij��k��=#z6��a����zݠi����l0�w�q�;�ezo�
Sections
.text Size: - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 238KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 5.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 7.6MB - Virtual size: 7.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 264KB - Virtual size: 263KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ