Behavioral task
behavioral1
Sample
5fbd17c24f1f9bda599a219ea1f2a7960e0f69cbf458e77e6f35f3084c6ca3feN.exe
Resource
win7-20240729-en
General
-
Target
5fbd17c24f1f9bda599a219ea1f2a7960e0f69cbf458e77e6f35f3084c6ca3feN
-
Size
1.8MB
-
MD5
fe5ef76360d0bce8597fb4a05ba748e0
-
SHA1
0d6fceb4fe48a5e84ff510d5110195f285a69c10
-
SHA256
5fbd17c24f1f9bda599a219ea1f2a7960e0f69cbf458e77e6f35f3084c6ca3fe
-
SHA512
18fd03b1ab14140f846e35ea6f458451ad7cdc8faa0eac175b02a1ac176a503fea56e441654e29f9bf6d205d41a9488a05b28f169d03b63bc20dd3853f27f187
-
SSDEEP
49152:8MnwyVxMoT7aTPjGKZDCrOf5vWskVJjrAW7d+Kg+pZ/:iaMoCTPzCOtm1h7ddZ/
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5fbd17c24f1f9bda599a219ea1f2a7960e0f69cbf458e77e6f35f3084c6ca3feN
Files
-
5fbd17c24f1f9bda599a219ea1f2a7960e0f69cbf458e77e6f35f3084c6ca3feN.exe windows:4 windows x86 arch:x86
d710e8f11219a310f44f3d9adc4976f5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutOpen
ws2_32
WSACleanup
kernel32
LCMapStringA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
GetClipboardData
gdi32
ScaleWindowExtEx
winspool.drv
DocumentPropertiesA
advapi32
RegCloseKey
shell32
Shell_NotifyIconA
ole32
CoTaskMemAlloc
oleaut32
SysStringLen
comctl32
ord17
oledlg
ord8
comdlg32
GetSaveFileNameA
Sections
.text Size: - Virtual size: 486KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 259KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 104KB - Virtual size: 117KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 365KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE