Behavioral task
behavioral1
Sample
9004bb9d8735f57c48d4b79608535b34413435507d61b53c6013769e747ba974.exe
Resource
win7-20240903-en
General
-
Target
9004bb9d8735f57c48d4b79608535b34413435507d61b53c6013769e747ba974
-
Size
6.2MB
-
MD5
af87ccad9f171ee90f847f963bedfffd
-
SHA1
71825c9b153308caa2a70de4e20eb69aa9958963
-
SHA256
9004bb9d8735f57c48d4b79608535b34413435507d61b53c6013769e747ba974
-
SHA512
2020bd18eda919ccb94a891bb61d3cabaa31f9aa8cba00b09ec85bb62027c6b9a91e1d98000ae809505639af0ea4e13caae3c66c0d620d7f7da141be28018637
-
SSDEEP
196608:HLPHdacOmAam8Zo9+SvvEVuRuimE4oc3CGZNv:xT0X8G9+S0V+ut15
Malware Config
Signatures
-
Processes:
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 9004bb9d8735f57c48d4b79608535b34413435507d61b53c6013769e747ba974
Files
-
9004bb9d8735f57c48d4b79608535b34413435507d61b53c6013769e747ba974.exe windows:5 windows x86 arch:x86
f7db03d07531e3bd1531d30039b67e7b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
RegisterWindowMessageA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
DeleteObject
winspool.drv
ClosePrinter
advapi32
RegSetValueExA
shell32
ShellExecuteA
shlwapi
PathFindFileNameA
oleaut32
VariantInit
wininet
InternetCloseHandle
wldap32
ord143
ws2_32
send
crypt32
CertFreeCertificateContext
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 408KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.1MB - Virtual size: 6.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 91KB - Virtual size: 91KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ