Behavioral task
behavioral1
Sample
e2aa0342b8b181d5ee2fb7dd5aa86ee16c6d16ad972bbdbf9cf2fc0a090e749fN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e2aa0342b8b181d5ee2fb7dd5aa86ee16c6d16ad972bbdbf9cf2fc0a090e749fN.exe
Resource
win10v2004-20240802-en
General
-
Target
e2aa0342b8b181d5ee2fb7dd5aa86ee16c6d16ad972bbdbf9cf2fc0a090e749fN
-
Size
76KB
-
MD5
f74e8e3d5761b565c70305feb5a62990
-
SHA1
13897c07b1b4232f0c6290ce74a214ebc59d8fea
-
SHA256
e2aa0342b8b181d5ee2fb7dd5aa86ee16c6d16ad972bbdbf9cf2fc0a090e749f
-
SHA512
680f728110a12b3ad96284d5424a00dbe5f36d5b46f76975bebeb1cf12db72bbe1a0da08e48e0b4c56fe2954830a1173b3c45352da74fca2dbe5a2cf8999665b
-
SSDEEP
1536:n73fbVp2op/PHqM7brxfCubT1pr+Pl8g/SVmd:7zvHUsrxfCipyW
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e2aa0342b8b181d5ee2fb7dd5aa86ee16c6d16ad972bbdbf9cf2fc0a090e749fN
Files
-
e2aa0342b8b181d5ee2fb7dd5aa86ee16c6d16ad972bbdbf9cf2fc0a090e749fN.exe windows:4 windows x86 arch:x86
59827368239ecd73f1fff91a4e709b3e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GlobalMemoryStatus
GetCurrentProcess
CreateProcessA
DeleteFileA
GetTempPathA
ExitProcess
TerminateProcess
WinExec
FindClose
GetComputerNameA
ResumeThread
SetThreadPriority
GetCurrentThread
SetPriorityClass
lstrcatA
GetEnvironmentVariableA
GetShortPathNameA
GetModuleFileNameA
GetLastError
CopyFileA
GetSystemDirectoryA
CompareStringW
CompareStringA
LCMapStringW
lstrlenA
CreateThread
WriteFile
CloseHandle
GetVersionExA
lstrcpyA
LoadLibraryA
GetProcAddress
GetTickCount
FreeLibrary
Sleep
ExitThread
FindFirstFileA
LCMapStringA
SetStdHandle
FlushFileBuffers
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
SetFilePointer
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
HeapReAlloc
GetTimeZoneInformation
GetSystemTime
GetLocalTime
HeapAlloc
RtlUnwind
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
HeapDestroy
HeapCreate
VirtualFree
HeapFree
VirtualAlloc
SetEnvironmentVariableA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
ExitWindowsEx
wsprintfA
MessageBoxA
advapi32
CloseServiceHandle
CreateServiceA
StartServiceA
RegOpenKeyA
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
SetServiceStatus
OpenSCManagerA
OpenServiceA
DeleteService
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
RegCreateKeyA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
shell32
ShellExecuteA
ws2_32
connect
closesocket
socket
htons
send
setsockopt
sendto
WSAStartup
WSACleanup
inet_addr
gethostbyname
inet_ntoa
htonl
recv
WSAGetLastError
WSASocketA
wininet
DeleteUrlCacheEntry
Sections
.text Size: - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 64KB - Virtual size: 61KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 52B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ