Behavioral task
behavioral1
Sample
prism.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
prism.exe
Resource
win10v2004-20240802-en
General
-
Target
prism.exe
-
Size
21.7MB
-
MD5
886a9b4a95d50394e30d40ed66db2c7c
-
SHA1
7049e12b97422b2811ff497dd973c33c62d18e1f
-
SHA256
e6935cb4ba91fb7dd852ac33e3a670002f3517bfd0e11f40e9abc0d84a6332b4
-
SHA512
e0b64e9b443f1e985a6ad0f167a97429b22a33f0184d3cdc461ec08fafbdaf6c703c33903fc84ef0886f4ca37aedd482b44266dc09ecaa0aaa8695d72203ad4e
-
SSDEEP
393216:KNJIUJt4haSVwzL33Ax8v15GOQxpMDjD6N5kluUhRftyF/DeTFB3y4oaxBIijMX:2JtJt4hfVSi415Nxj0mhhRftyRD8LoM4
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource prism.exe
Files
-
prism.exe.exe windows:6 windows x64 arch:x64
342d680cf75246ab02c672e0d5b5177d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_NET_RUN_FROM_SWAP
Imports
comctl32
ImageList_DrawIndirect
oledlg
OleUIEditLinksW
odbc32
ord26
wininet
FtpFindFirstFileW
version
GetFileVersionInfoSizeW
gdiplus
GdipGetDC
msimg32
AlphaBlend
imm32
ImmIsUIMessageW
kernel32
GetVersionExW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DrawFrameControl
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
BitBlt
winspool.drv
DocumentPropertiesW
comdlg32
GetSaveFileNameW
advapi32
InitializeSecurityDescriptor
shell32
ShellExecuteW
ole32
OleFlushClipboard
oleaut32
GetActiveObject
secur32
InitSecurityInterfaceW
usp10
ScriptStringAnalyse
dwmapi
DwmGetWindowAttribute
shlwapi
PathRemoveBackslashW
wintrust
WinVerifyTrust
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 17.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 7.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 910KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: - Virtual size: 649B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 19.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 21.4MB - Virtual size: 21.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 335KB - Virtual size: 334KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ