Behavioral task
behavioral1
Sample
d621366dbc2904844ea141f4289ba3a0ed9525e50ca2de2d92800c650802a0ed.exe
Resource
win7-20241010-en
General
-
Target
d621366dbc2904844ea141f4289ba3a0ed9525e50ca2de2d92800c650802a0ed
-
Size
767KB
-
MD5
a10c11e217a90031e06b79fa875439c8
-
SHA1
6645217ae83979b475ea53e8803908c565a8488f
-
SHA256
d621366dbc2904844ea141f4289ba3a0ed9525e50ca2de2d92800c650802a0ed
-
SHA512
69a1bb17d8f58c923ca4f8225300e829b811296ab466bfd5ffb27897d03a08a124ddf021c0523bf1e4ab4848ca421f263cab445d2993985d897426d0cd3290a4
-
SSDEEP
12288:8HvSRihoGDU4X485BsQ5bc2VyrIIoVbpRkyVeQkMyk/W9L56AtDoWgv7bxcx1itq:2O4U4L5ee42Aqb4yV+3ooVgv7+x1GtG
Malware Config
Signatures
-
Processes:
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource d621366dbc2904844ea141f4289ba3a0ed9525e50ca2de2d92800c650802a0ed
Files
-
d621366dbc2904844ea141f4289ba3a0ed9525e50ca2de2d92800c650802a0ed.exe windows:6 windows x86 arch:x86
d8a000507dece8d77687b218a2187d23
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
winhttp
WinHttpConnect
shlwapi
PathFileExistsA
shell32
SHChangeNotify
advapi32
OpenProcessToken
user32
TranslateMessage
netapi32
Netbios
kernel32
GetStringTypeW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Sections
.text Size: - Virtual size: 227KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 614KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 763KB - Virtual size: 763KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 196B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ