Behavioral task
behavioral1
Sample
65c4b1871dc4e14cc9c64101429f7ade36edc3f33cbce87ea4352487acccb9cc.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
65c4b1871dc4e14cc9c64101429f7ade36edc3f33cbce87ea4352487acccb9cc.exe
Resource
win10v2004-20241007-en
General
-
Target
65c4b1871dc4e14cc9c64101429f7ade36edc3f33cbce87ea4352487acccb9cc
-
Size
5.0MB
-
MD5
b04f4429175de0c7877d3e3350562dc5
-
SHA1
93ff7b48c14a3365f50428d11a9b52d514cf0647
-
SHA256
65c4b1871dc4e14cc9c64101429f7ade36edc3f33cbce87ea4352487acccb9cc
-
SHA512
c7250d1c974af788c1e0d76cff67599a61c708b94c5424ae03db23fb6a2fd531cacb0a0b4d32312594b50f549ada66c5d4c46971dfe0e276de64a71b30d1856f
-
SSDEEP
98304:ghO7wbNPT70hIIy7wBX15r4wgmbkC13QQwDPQgRie:47L7iIIy7wt0G13xwc8ie
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 65c4b1871dc4e14cc9c64101429f7ade36edc3f33cbce87ea4352487acccb9cc
Files
-
65c4b1871dc4e14cc9c64101429f7ade36edc3f33cbce87ea4352487acccb9cc.exe windows:5 windows x86 arch:x86
72995b4200dd8af90437fca3418342a3
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42d
ord901
msvcrtd
_except_handler3
kernel32
GetTickCount
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
msvcp60d
??1_Winit@std@@QAE@XZ
wsock32
getsockname
user32
FindWindowA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.0MB - Virtual size: 5.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ