Behavioral task
behavioral1
Sample
bf85a65b7a02f478067096beb65247fa939168a86c9cecd627fa7dc4e5039079.exe
Resource
win7-20240903-en
General
-
Target
bf85a65b7a02f478067096beb65247fa939168a86c9cecd627fa7dc4e5039079
-
Size
2.1MB
-
MD5
28ca1f31722ef19205362c14f3a93dde
-
SHA1
de835aa32e762f476b76595b2c8b7ec94457483f
-
SHA256
bf85a65b7a02f478067096beb65247fa939168a86c9cecd627fa7dc4e5039079
-
SHA512
3df3c071f08cce5f4131e9c242bc2eceade72b3243ea08f22102dd8919fef10ab8304aca4a98a41047bf3bcef36f687cd14dfd92326cb4b1abc8fd41b2db5ac1
-
SSDEEP
49152:K3oSK+8UROIoQ6tgQYObbvr1qi1vwOOFrNoztQfZjEwtkpV+:tSQUROIoftS2jr1B4OO56zKfZjEqkv+
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bf85a65b7a02f478067096beb65247fa939168a86c9cecd627fa7dc4e5039079
Files
-
bf85a65b7a02f478067096beb65247fa939168a86c9cecd627fa7dc4e5039079.exe windows:5 windows x86 arch:x86
960f8aa3c54ea636b355668e4de42052
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
OffsetRect
kernel32
GetVersionExA
GetVersion
GetVersionExA
GetVersion
GetCPInfo
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdiplus
GdipDrawRectangleI
ole32
CLSIDFromString
gdi32
FillRgn
imm32
ImmSetCompositionWindow
shell32
ShellExecuteA
winspool.drv
ClosePrinter
advapi32
RegQueryValueA
comctl32
ord17
shlwapi
PathFileExistsA
winmm
midiStreamOut
ws2_32
closesocket
oleaut32
LoadTypeLi
comdlg32
GetOpenFileNameA
Sections
.text Size: - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 274KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 759KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ