Behavioral task
behavioral1
Sample
298a433691049122d54b2e0b9dba6b8da6e992f0129565229f45c41c9881514d.exe
Resource
win7-20220812-en
General
-
Target
298a433691049122d54b2e0b9dba6b8da6e992f0129565229f45c41c9881514d
-
Size
382.3MB
-
MD5
6bd50c2ee32d2f045293255218b61452
-
SHA1
7e7f5b03e4d5f693988667451b0c3000a3645b2a
-
SHA256
298a433691049122d54b2e0b9dba6b8da6e992f0129565229f45c41c9881514d
-
SHA512
ae31305edae93c695065aa0ccaf54678112e58415b1e5b8189125d7035627c0ceeda19c78e37c2002726348bd8df10fecee3016e2e5590d3440dcf402129ea99
-
SSDEEP
196608:mr+M/9knU7aRgfeqmshM0cbpsN6t0y7d+:mr+M/qU70gfZm8MDbpsN6tZ0
Malware Config
Signatures
-
Processes:
resource yara_rule sample vmprotect
Files
-
298a433691049122d54b2e0b9dba6b8da6e992f0129565229f45c41c9881514d.exe windows x86
9a9cbbdedbaffb7ca84b42ca0c8d95b9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcessHeap
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
shell32
ShellExecuteA
crypt32
CryptStringToBinaryA
user32
CharUpperBuffW
Sections
.text Size: - Virtual size: 199KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ŪЏūŬ Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
ŪЏūŬ Size: - Virtual size: 546KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 5.1MB - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ