fun
Behavioral task
behavioral1
Sample
17f50fb3a82abe9a3a86c632d0db4ecbce332c83d9d125ed896fb10d8295a80f.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
17f50fb3a82abe9a3a86c632d0db4ecbce332c83d9d125ed896fb10d8295a80f.dll
Resource
win10v2004-20220812-en
General
-
Target
17f50fb3a82abe9a3a86c632d0db4ecbce332c83d9d125ed896fb10d8295a80f
-
Size
48KB
-
MD5
3b28401473930a7d674ed088879e47e1
-
SHA1
c025e2bd5495319b32291adfaa8812d30a6b063b
-
SHA256
17f50fb3a82abe9a3a86c632d0db4ecbce332c83d9d125ed896fb10d8295a80f
-
SHA512
58f0d665debe444ab430d5e4dd58229f32721f9f71fe34f7d453b859f77e058461fb4168deba4ddbfac6d066f54a86bd8f71355130fc7ceeef7b60ce69dd5dee
-
SSDEEP
384:Z+OmS2W7mv9lLRBK/CkHnNgdO7K8XNOxJKJx02UB+8prdjyjHm/GPsPPPcRx519/:797mv9l1BLkHnNgypdTxPkCngPc7Ns4
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
17f50fb3a82abe9a3a86c632d0db4ecbce332c83d9d125ed896fb10d8295a80f.dll windows x86
a45b1728952f86a32528fdc64eb6e759
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
recv
send
user32
FindWindowA
GetWindowTextA
CallNextHookEx
SetWindowsHookExA
msvcrt
_adjust_fdiv
malloc
free
strlen
memcpy
sprintf
memset
strncpy
atoi
strstr
_initterm
kernel32
DeleteFileA
WriteFile
GetCurrentProcessId
VirtualProtectEx
WriteProcessMemory
GetSystemDirectoryA
CreateThread
LoadLibraryA
GetProcAddress
CreateFileA
ReadFile
CloseHandle
Sleep
GetModuleHandleA
GetModuleFileNameA
lstrcpyA
GetCurrentProcess
TerminateProcess
Exports
Exports
Sections
.text Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1023B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 926B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.vmp0 Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ