Behavioral task
behavioral1
Sample
27a07e89ea0613e066667df2f642378c61b85654e234445fda636e56fb164286.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
27a07e89ea0613e066667df2f642378c61b85654e234445fda636e56fb164286.dll
Resource
win10v2004-20240802-en
General
-
Target
27a07e89ea0613e066667df2f642378c61b85654e234445fda636e56fb164286
-
Size
156KB
-
MD5
e7c8f35642cbcc63aa8471813a5f38c2
-
SHA1
50d86cb2a4a9dc89535c4d54ad025a24a6571d8f
-
SHA256
27a07e89ea0613e066667df2f642378c61b85654e234445fda636e56fb164286
-
SHA512
21e359bfe8362e9ea4c420af4794d117cb61fc9cbbcdf16a5e9dbd7ee285d883e43d44305437e9339fdd74cb95708cf800d83bb89f9f11b4cf23abddbfa078c7
-
SSDEEP
3072:eUpcSKyRj+o91NRPz6N+TBflnno/yBIUeOjT4U7j8Ap:9iXI/1NRr6N+TBXIAjT42jL
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 27a07e89ea0613e066667df2f642378c61b85654e234445fda636e56fb164286
Files
-
27a07e89ea0613e066667df2f642378c61b85654e234445fda636e56fb164286.dll windows:4 windows x86 arch:x86
afe929a2bc6373a2c3c3525a9976770c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
VirtualAlloc
CloseHandle
VirtualProtectEx
OpenProcess
GetCurrentProcessId
GetModuleHandleA
VirtualProtect
GetLastError
GetFileAttributesA
Process32Next
Process32First
CreateToolhelp32Snapshot
CreateProcessA
Sleep
FindNextFileA
FindClose
FindFirstFileA
VirtualFree
LoadLibraryA
GetFileSize
GetLocalTime
FileTimeToSystemTime
GetFileTime
CreateFileA
HeapFree
HeapAlloc
GetProcessHeap
OutputDebugStringA
CreateThread
DeleteFileA
WriteFile
CreateMutexA
GetComputerNameA
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetProcAddress
WriteConsoleA
GetConsoleCursorInfo
SetConsoleCursorInfo
SetConsoleWindowInfo
FreeConsole
AllocConsole
SetConsoleTitleA
GetStdHandle
GetConsoleScreenBufferInfo
ReadFile
SetConsoleTextAttribute
SetStdHandle
GetOEMCP
GetACP
GetStringTypeW
GetStringTypeA
FlushFileBuffers
LCMapStringW
LCMapStringA
MultiByteToWideChar
SetFilePointer
InterlockedDecrement
InterlockedIncrement
GetTimeZoneInformation
GetSystemTime
RtlUnwind
GetCommandLineA
GetVersion
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
WideCharToMultiByte
TerminateProcess
GetCurrentProcess
HeapReAlloc
HeapSize
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetCPInfo
user32
ReleaseDC
wsprintfA
gdi32
CreateCompatibleDC
GetDeviceCaps
CreateCompatibleBitmap
SelectObject
BitBlt
GetStockObject
SelectPalette
RealizePalette
GetDIBits
DeleteDC
CreateDCA
shell32
SHGetSpecialFolderPathA
urlmon
URLDownloadToFileA
ws2_32
send
closesocket
socket
htons
connect
inet_addr
recv
WSAStartup
WSACleanup
shlwapi
PathFindFileNameA
Sections
.text Size: 56KB - Virtual size: 54KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 160B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 48KB - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ