Behavioral task
behavioral1
Sample
2908-19-0x0000000000400000-0x0000000000448000-memory.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
2908-19-0x0000000000400000-0x0000000000448000-memory.exe
Resource
win10v2004-20250217-en
General
-
Target
2908-19-0x0000000000400000-0x0000000000448000-memory.dmp
-
Size
288KB
-
MD5
a88bcc31f3631b36446346a5e7df6c40
-
SHA1
d51af6b9330fc0cbccc9bbb727291b0068157bb1
-
SHA256
5e98ba927899d7ded6047116ccd30dacbf75f1fbb8628dc90a5d9ba66a645cde
-
SHA512
dfce67e0091f33cc10e093b64c8bb457aa6358ff9e619cf5677704fc83886340c9dd13560b1dca2f716db2dfd53d7676a36db3b7ad3858fdbfeb17a5b99396f7
-
SSDEEP
3072:Ci8zGMcOGgRcO+X+iS9ScSjSWSYSLnX3ozy8NRPEhaL5JDl7jtbyPugt+1gG4mij:jVtVud87ehnETDLt9bAttGSqb
Malware Config
Extracted
vipkeylogger
Signatures
-
Vipkeylogger family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2908-19-0x0000000000400000-0x0000000000448000-memory.dmp
Files
-
2908-19-0x0000000000400000-0x0000000000448000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 261KB - Virtual size: 260KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ