Behavioral task
behavioral1
Sample
003fd009b324589490808075e04904063b70b12ab4254f6415e47db535e99932N.exe
Resource
win7-20240704-en
General
-
Target
003fd009b324589490808075e04904063b70b12ab4254f6415e47db535e99932N
-
Size
7.3MB
-
MD5
14bc5d05f19bfc075e47053d2573a290
-
SHA1
e95e352a5214332f586aba34d6667a1177911b22
-
SHA256
003fd009b324589490808075e04904063b70b12ab4254f6415e47db535e99932
-
SHA512
693019822535d55753d9e9b78156b7bf4ff3aa9d2ea1364eea71282463dab25b369319393ad122e669bcd182b206b10aa6a97a6fab35dae142ccf2694c166fb5
-
SSDEEP
196608:SX+Yw5nDI3WDIqerSjB/QuZ2Mz98VBWFeRKN2WhH8hJVt7X8K:m+TtiWP2M58rYnngJ3D
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 003fd009b324589490808075e04904063b70b12ab4254f6415e47db535e99932N
Files
-
003fd009b324589490808075e04904063b70b12ab4254f6415e47db535e99932N.exe windows:5 windows x86 arch:x86
e71a09ee7210f070b9c46b0f92966798
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExW
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetKeyNameTextW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
CreateFontIndirectW
msimg32
AlphaBlend
comdlg32
GetFileTitleW
winspool.drv
ClosePrinter
advapi32
RegQueryValueExW
shell32
DragQueryFileW
comctl32
InitCommonControlsEx
shlwapi
PathFindFileNameW
ole32
RevokeDragDrop
oleaut32
SysFreeString
gdiplus
GdipGetImageGraphicsContext
oleacc
LresultFromObject
imm32
ImmGetOpenStatus
winmm
PlaySoundW
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 263KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 4.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 7.3MB - Virtual size: 7.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 69KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ