Behavioral task
behavioral1
Sample
d2adfbedd6d1ff4f86a97039871b51056372e9de303a8824ae3d81bb020b24a9N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
d2adfbedd6d1ff4f86a97039871b51056372e9de303a8824ae3d81bb020b24a9N.exe
Resource
win10v2004-20240802-en
General
-
Target
d2adfbedd6d1ff4f86a97039871b51056372e9de303a8824ae3d81bb020b24a9N
-
Size
552KB
-
MD5
93fef84568d2aefa7bda8d2132004700
-
SHA1
d87b6a5c3e8f4f8feff69cdfabfdc30811ffe507
-
SHA256
d2adfbedd6d1ff4f86a97039871b51056372e9de303a8824ae3d81bb020b24a9
-
SHA512
5f681814f2f65032ab9c8f9d81f71478ecc10ccfa6c27c9418040dac7afa26ed0d2462c893ce90665ad41f6479b55d837ba19703c16f3ed5a8018cc83a3d3012
-
SSDEEP
12288:V7pGeZOaHTusMHtbkgSp42Fb3sGhsTYqCspRjxD:zGRQjMNtSp421DsPCspRND
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d2adfbedd6d1ff4f86a97039871b51056372e9de303a8824ae3d81bb020b24a9N
Files
-
d2adfbedd6d1ff4f86a97039871b51056372e9de303a8824ae3d81bb020b24a9N.exe windows:4 windows x86 arch:x86
617c14e39273b898a71d78f25cf74018
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
RtlUnwind
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBeep
MessageBoxA
gdi32
SetWindowExtEx
comdlg32
GetFileTitleA
winspool.drv
DocumentPropertiesA
advapi32
LookupPrivilegeValueA
shell32
Shell_NotifyIconA
comctl32
ord17
oledlg
ord8
ole32
CoFreeUnusedLibraries
olepro32
ord253
oleaut32
VariantChangeType
urlmon
URLDownloadToFileA
wininet
InternetGetLastResponseInfoA
netapi32
Netbios
winmm
sndPlaySoundA
psapi
EmptyWorkingSet
Sections
.text Size: - Virtual size: 420KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 103KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 281KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 532KB - Virtual size: 528KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 136B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ