C:\Jenkins\workspace\DnfClient\Bin\VmpDll\DnfClient.pdb
Behavioral task
behavioral1
Sample
e498ba44ba9d5dc234fce25fb9bc349191a670e7d362e1346bdac1de09c70a7d.dll
Resource
win7-20240903-en
General
-
Target
e498ba44ba9d5dc234fce25fb9bc349191a670e7d362e1346bdac1de09c70a7d
-
Size
1.3MB
-
MD5
2439a52f32d07031182b88fbb63c7669
-
SHA1
5fba2f0026b312c9256bcfe8f1173dfc1ecff493
-
SHA256
e498ba44ba9d5dc234fce25fb9bc349191a670e7d362e1346bdac1de09c70a7d
-
SHA512
dbd80cd4bfc44778bc86924cc25dd1c5afb7f608bd2de0a3cbdf9e400d5edd23e6cd33f3254a390591a61e6c006b6f3f9c409d5be960a9f37cab9cc8e4efd7b9
-
SSDEEP
24576:ys388UeoDEhkagAsmve1xH7TOIZpvplFlppPn+tyCKC4aCCC3SkYIpDrVn+sp8R2:yso4mOsmm1xHOgVppPeyCKOYBtFykbT
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e498ba44ba9d5dc234fce25fb9bc349191a670e7d362e1346bdac1de09c70a7d
Files
-
e498ba44ba9d5dc234fce25fb9bc349191a670e7d362e1346bdac1de09c70a7d.dll windows:6 windows x86 arch:x86
bac810d854e5327992196e33c490dc3f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ws2_32
setsockopt
kernel32
UnhandledExceptionFilter
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
DispatchMessageW
advapi32
LookupPrivilegeValueW
shell32
ShellExecuteW
psapi
GetProcessImageFileNameW
iphlpapi
GetIpForwardTable
shlwapi
StrChrW
winmm
timeGetTime
Sections
.text Size: 257KB - Virtual size: 256KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 57KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 876KB - Virtual size: 876KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 97KB - Virtual size: 97KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 868B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ