Behavioral task
behavioral1
Sample
a44aaf3709442e9cc55170603f0220d6690e74fb419a533cfaf9096d9935df8e.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
a44aaf3709442e9cc55170603f0220d6690e74fb419a533cfaf9096d9935df8e.exe
Resource
win10v2004-20240802-en
General
-
Target
a44aaf3709442e9cc55170603f0220d6690e74fb419a533cfaf9096d9935df8e
-
Size
6.0MB
-
MD5
8b99adcb50e8c71c2194cc1937138d25
-
SHA1
e568ff3a07bee04e597a3ac29d5fda30b1924dfc
-
SHA256
a44aaf3709442e9cc55170603f0220d6690e74fb419a533cfaf9096d9935df8e
-
SHA512
284ac305a806f9b34a1f5ea850d3d96eb7e202647df9fdb717dd88308a9264c5fa07c017b11cb7a332147a983579e9c3a9e8c545a4c2b8e510567f57f48648d2
-
SSDEEP
98304:YF9ofb3r6YheNc6hNvhlO2eml+8qRb0SCJX8VhVgMeUY8kOnAPP8Khx2L:YF9gb3rxSZlhlO2e1pSJXYhVgMY8kk4G
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a44aaf3709442e9cc55170603f0220d6690e74fb419a533cfaf9096d9935df8e
Files
-
a44aaf3709442e9cc55170603f0220d6690e74fb419a533cfaf9096d9935df8e.exe windows:5 windows x86 arch:x86
4b3a89d570f980432135b8aff42bf940
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvfw32
DrawDibDraw
avifil32
AVIStreamGetFrame
winmm
midiStreamProperty
ws2_32
WSAAsyncSelect
kernel32
GetVersionExA
GetVersionExW
GetVersion
CreateEventA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetCapture
gdi32
RectVisible
msimg32
GradientFill
winspool.drv
ClosePrinter
comdlg32
GetSaveFileNameA
advapi32
CryptGetHashParam
shell32
ShellExecuteA
ole32
CLSIDFromProgID
oleaut32
LHashValOfNameSys
comctl32
ImageList_DragMove
Sections
.text Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 496KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 6.0MB - Virtual size: 6.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ