Behavioral task
behavioral1
Sample
6f87f52cdc2d9e3aed42f35f3a6ff251781d31f6f901bc65fa603acfc66bda25.exe
Resource
win7-20240903-en
General
-
Target
6f87f52cdc2d9e3aed42f35f3a6ff251781d31f6f901bc65fa603acfc66bda25
-
Size
9.2MB
-
MD5
ea6574e95ee5034baf1062d21dd8b72c
-
SHA1
90bf4262636379d4e1e7420cb9eecaa383356a27
-
SHA256
6f87f52cdc2d9e3aed42f35f3a6ff251781d31f6f901bc65fa603acfc66bda25
-
SHA512
c92aff8853d2d29381f103e1cc1ea4d6a55b18a156eae5ff799f465974903e2cea744851cdfd89bf0e9fb51eac28b373efc4c6bec9f6c8789a21c96d1bc08c6b
-
SSDEEP
196608:ELHCTCPwaid5BTxmGmze1lWNbKsg5xgfgX/mSJ9uN8aWAt:VkwZ5Bxm7izWNbKsg5BmSJbaWK
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6f87f52cdc2d9e3aed42f35f3a6ff251781d31f6f901bc65fa603acfc66bda25
Files
-
6f87f52cdc2d9e3aed42f35f3a6ff251781d31f6f901bc65fa603acfc66bda25.exe windows:5 windows x86 arch:x86
a21650863975ab15880f1100bb0f71b9
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
EmptyClipboard
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetTextExtentPoint32W
gdiplus
GdipGetStringFormatAlign
kernel32
GetVersionExA
GetVersion
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
ole32
CreateStreamOnHGlobal
shell32
DragFinish
imm32
ImmGetCompositionStringA
shlwapi
PathFileExistsA
winmm
timeBeginPeriod
advapi32
StartServiceA
ws2_32
WSAStartup
version
GetFileVersionInfoA
wininet
InternetReadFile
winhttp
WinHttpQueryHeaders
oleaut32
SafeArrayUnaccessData
psapi
GetModuleFileNameExA
dbghelp
MakeSureDirectoryPathExists
comctl32
ImageList_GetIcon
urlmon
URLDownloadToFileA
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 814KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 4.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 9.2MB - Virtual size: 9.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE