Behavioral task
behavioral1
Sample
3eb595e5017e8f5e5c9414e973919fe47972be4e020b2a5808715ec8f81a581dN.dll
Resource
win7-20240903-en
General
-
Target
3eb595e5017e8f5e5c9414e973919fe47972be4e020b2a5808715ec8f81a581dN
-
Size
787KB
-
MD5
6d242c8af0f3e3641494d6b704a862d0
-
SHA1
33c5c3a2eb3583a5153e75f5126c998325ffd6db
-
SHA256
3eb595e5017e8f5e5c9414e973919fe47972be4e020b2a5808715ec8f81a581d
-
SHA512
2e959f3aa83f5fef93e8d2bd059207f3efac92172bf7738ee169cd6a0546e7bbcda6f99b1b3758f799938fa1f1fac3981cc1c63f39c7dc959c900d8787be5593
-
SSDEEP
24576:hdlsAsArI7hjlA2a8rTPzWygAEJ4nNIk:hDsAsbta8HiygPkI
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3eb595e5017e8f5e5c9414e973919fe47972be4e020b2a5808715ec8f81a581dN
Files
-
3eb595e5017e8f5e5c9414e973919fe47972be4e020b2a5808715ec8f81a581dN.dll windows:4 windows x86 arch:x86
80e6f3c7a8a2e287310c3d8ed44dd52a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetVersionExA
GetVersion
GetVersionExA
GetVersion
FindFirstFileW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SystemParametersInfoA
advapi32
RegCloseKey
oleaut32
SysAllocStringLen
version
GetFileVersionInfoSizeA
gdi32
GetDIBits
ole32
OleSetMenuDescriptor
comctl32
ImageList_DrawEx
shell32
SHGetSpecialFolderPathA
wininet
DeleteUrlCacheEntry
urlmon
URLDownloadToFileW
wsock32
WSAStartup
ntdll
NtCreateSection
iphlpapi
GetExtendedTcpTable
oleacc
AccessibleObjectFromWindow
gdiplus
GdipFree
imagehlp
MapFileAndCheckSumA
atl
AtlAxWinInit
ws2_32
WSAIoctl
Sections
CODE Size: - Virtual size: 781KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 103KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 14KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 774KB - Virtual size: 773KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 104B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ