Behavioral task
behavioral1
Sample
ab66ba6f3cc041e7cbd8d48756ee85e0f720de35ec873d7eb83ff8351ef15f53.exe
Resource
win7-20240903-en
General
-
Target
ab66ba6f3cc041e7cbd8d48756ee85e0f720de35ec873d7eb83ff8351ef15f53
-
Size
3.8MB
-
MD5
e141e8c64f45aac6918d1da6eba8dd4e
-
SHA1
e23dcd7a8db478eb3fc967d7b2788c0cb0e8d757
-
SHA256
ab66ba6f3cc041e7cbd8d48756ee85e0f720de35ec873d7eb83ff8351ef15f53
-
SHA512
d0ccf4cc3e4b90228b2b7034ebc75176605bccc533980bef9d0dd03490003e83ea1aec5b903eea2625a2c6c40fb60b293da8c411abe15376609774d511a8198b
-
SSDEEP
98304:CfWKNBnmVQBAmH96+Dn0Z2TYTb6rAzPiLqX7q8u:AnBRBR9jzY2Te8iiLM7q8
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ab66ba6f3cc041e7cbd8d48756ee85e0f720de35ec873d7eb83ff8351ef15f53
Files
-
ab66ba6f3cc041e7cbd8d48756ee85e0f720de35ec873d7eb83ff8351ef15f53.exe windows:5 windows x86 arch:x86
cd50e898d55dec8a2b361a50994d15d6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExW
GetVersion
GetVersionExA
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
CharUpperBuffW
advapi32
GetSidSubAuthorityCount
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
shell32
SHGetSpecialFolderPathW
ole32
CoInitialize
oleaut32
SysAllocString
shlwapi
PathIsRelativeW
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 256KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 3.7MB - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 312B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 92KB - Virtual size: 91KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ