Behavioral task
behavioral1
Sample
36c8f9ab3159c0d21c80353c5e205b7c4907eb5d6bd40ae4d4871d3e8d41c96a.exe
Resource
win7-20240903-en
General
-
Target
36c8f9ab3159c0d21c80353c5e205b7c4907eb5d6bd40ae4d4871d3e8d41c96a
-
Size
8.6MB
-
MD5
bf9d530b2f4c1ab748ac1966498f1bc3
-
SHA1
e15b29a5478150e0efc54b0ba0c3c58dfd727987
-
SHA256
36c8f9ab3159c0d21c80353c5e205b7c4907eb5d6bd40ae4d4871d3e8d41c96a
-
SHA512
5abe5ef948d83332e096269fcc158e05c5c7e7b8d0166edf9a18a73bdd131e286b40f4e9cd81e172f53166c1ac6e67b034df5ccd230c210ca1de46796ce2e5da
-
SSDEEP
196608:UOkvAy6rSU/Ijs7MBpKilex4nPntYr5H4+qRsxfy5R:UOk8lYKiluePntyK/
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 36c8f9ab3159c0d21c80353c5e205b7c4907eb5d6bd40ae4d4871d3e8d41c96a
Files
-
36c8f9ab3159c0d21c80353c5e205b7c4907eb5d6bd40ae4d4871d3e8d41c96a.exe windows:5 windows x86 arch:x86
959d17493da057ab5534ebcad874e2eb
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasGetConnectStatusA
kernel32
GetVersion
GetVersionExA
UnhandledExceptionFilter
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetSysColorBrush
gdi32
GetDeviceCaps
winmm
waveOutOpen
winspool.drv
OpenPrinterA
advapi32
RegDeleteKeyA
shell32
ShellExecuteA
ole32
CLSIDFromString
oleaut32
LoadTypeLi
comctl32
ord17
ws2_32
ntohs
wininet
InternetSetOptionA
comdlg32
GetFileTitleA
Sections
.text Size: - Virtual size: 873KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 341KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 4.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 8.6MB - Virtual size: 8.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ