Behavioral task
behavioral1
Sample
307b20c9dcc60f42fd8cd96c689ca248c19ea107a397085fb8b9c4334122491b.dll
Resource
win7-20240704-en
General
-
Target
307b20c9dcc60f42fd8cd96c689ca248c19ea107a397085fb8b9c4334122491b
-
Size
783KB
-
MD5
86e759b092de495446f1873bb02d76a4
-
SHA1
ef263907e667abf3ed562d752ef33569aeac682a
-
SHA256
307b20c9dcc60f42fd8cd96c689ca248c19ea107a397085fb8b9c4334122491b
-
SHA512
c5cab4c2365f995f777752a5bef3224486c9f332f1321d34e9eec7bf327aa79b53106d0ec178271765f0f7b1b664fe7dd3e1b492eda88e7ab5529bdd2be0554a
-
SSDEEP
24576:gdlsAsArI7hjlA2a8rTPzWygAEJ4nNIk:gDsAsbta8HiygPkI
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 307b20c9dcc60f42fd8cd96c689ca248c19ea107a397085fb8b9c4334122491b
Files
-
307b20c9dcc60f42fd8cd96c689ca248c19ea107a397085fb8b9c4334122491b.dll windows:4 windows x86 arch:x86
80e6f3c7a8a2e287310c3d8ed44dd52a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetVersionExA
GetVersion
GetVersionExA
GetVersion
FindFirstFileW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SystemParametersInfoA
advapi32
RegCloseKey
oleaut32
SysAllocStringLen
version
GetFileVersionInfoSizeA
gdi32
GetDIBits
ole32
OleSetMenuDescriptor
comctl32
ImageList_DrawEx
shell32
SHGetSpecialFolderPathA
wininet
DeleteUrlCacheEntry
urlmon
URLDownloadToFileW
wsock32
WSAStartup
ntdll
NtCreateSection
iphlpapi
GetExtendedTcpTable
oleacc
AccessibleObjectFromWindow
gdiplus
GdipFree
imagehlp
MapFileAndCheckSumA
atl
AtlAxWinInit
ws2_32
WSAIoctl
Sections
CODE Size: - Virtual size: 781KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 103KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 14KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 774KB - Virtual size: 773KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 104B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ