General
-
Target
jKPeSMhaBb.dll
-
Size
9.0MB
-
Sample
220203-mswmfsgaa7
-
MD5
71de56304b7c5bf604a2c63c27fee89b
-
SHA1
84b63bc607afa5ed4401a618e896f5a511dbeb20
-
SHA256
7941b73b753797e4926d9df968f5e6b101dc23d7312569ae2af784262f532353
-
SHA512
ee7f465a235ec63163a4ac93e0b120daf7b1e66a11ef0046a87f9d90923760ea47882fc5eda5a1caf8814fc2e0e74cd769c9b88e0de7488701c9b9556edbf406
Static task
static1
Behavioral task
behavioral1
Sample
jKPeSMhaBb.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
jKPeSMhaBb.dll
Resource
win10v2004-en-20220112
Malware Config
Targets
-
-
Target
jKPeSMhaBb.dll
-
Size
9.0MB
-
MD5
71de56304b7c5bf604a2c63c27fee89b
-
SHA1
84b63bc607afa5ed4401a618e896f5a511dbeb20
-
SHA256
7941b73b753797e4926d9df968f5e6b101dc23d7312569ae2af784262f532353
-
SHA512
ee7f465a235ec63163a4ac93e0b120daf7b1e66a11ef0046a87f9d90923760ea47882fc5eda5a1caf8814fc2e0e74cd769c9b88e0de7488701c9b9556edbf406
Score10/10-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Sets service image path in registry
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-