Behavioral task
behavioral1
Sample
bb8e965ab123276f5d80645a05e62aaf1ba1d5f09c11fcae798bc25f99e29274.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
bb8e965ab123276f5d80645a05e62aaf1ba1d5f09c11fcae798bc25f99e29274.dll
Resource
win10v2004-20220812-en
General
-
Target
bb8e965ab123276f5d80645a05e62aaf1ba1d5f09c11fcae798bc25f99e29274
-
Size
712KB
-
MD5
1300523ca4f34ac2b95ea1c597a6f6e2
-
SHA1
f16f52521098a0035870ac3a9a81f6b3c23dbea9
-
SHA256
bb8e965ab123276f5d80645a05e62aaf1ba1d5f09c11fcae798bc25f99e29274
-
SHA512
82fc43e217ed248e7dce159f3089a45cf83d988369e87b45079ef41058948c2839bf1c748e0e4f9cb01448d4c8dc11727b6beff5263141379a8914e85e71f09c
-
SSDEEP
12288:+fIxy5B7DJ3rVnVjZUy/LwecyfCwv0ZgV+3VwBf29T3vgplM7u83p4SXvZd:+D5B7DJ3rN5Cwv0ZgV62fUgIKEpR//
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
bb8e965ab123276f5d80645a05e62aaf1ba1d5f09c11fcae798bc25f99e29274.dll windows x86
92c75adb8bd08f24d1cb9def3b7a2a3e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
LoadLibraryA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
UpdateWindow
MessageBoxA
advapi32
RegOpenKeyExA
oleaut32
VariantInit
version
GetFileVersionInfoA
gdi32
CreateCompatibleDC
comctl32
ImageList_Write
shell32
ShellExecuteA
Sections
CODE Size: - Virtual size: 537KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 7KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 341KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 707KB - Virtual size: 706KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ