Behavioral task
behavioral1
Sample
d1009cd62eb9be004741d77452b80d1f1d983e4ccb1ae8a148a852b6347f4181.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d1009cd62eb9be004741d77452b80d1f1d983e4ccb1ae8a148a852b6347f4181.exe
Resource
win10v2004-20220812-en
General
-
Target
d1009cd62eb9be004741d77452b80d1f1d983e4ccb1ae8a148a852b6347f4181
-
Size
326KB
-
MD5
0488ed06d30cb151231268bfcbb6bdc0
-
SHA1
ab45232aa529f8a60991548c5d49cefe0da76f4a
-
SHA256
d1009cd62eb9be004741d77452b80d1f1d983e4ccb1ae8a148a852b6347f4181
-
SHA512
dcb8bf4edec5e3b46bfe7fad739f02403de04f7a83857bcc9fd9795e6ef38701ba52f32637ea133559bf34e4dc15805d7c87e7e52ebc923ad876ae85ef753919
-
SSDEEP
6144:vKBrEz5FsL2vwNi/+po271dVAGp2pXThGFrDkyp0p0v01DwH2NGsmeKJ0pTAJXoJ:S235qm+Kg52pXThGmyp80v018BWB+4lL
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
d1009cd62eb9be004741d77452b80d1f1d983e4ccb1ae8a148a852b6347f4181.exe windows x86
9e0e194919a69e694bda91a4a90a11c4
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
PsGetVersion
IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
ExAllocatePool
ExFreePool
NtQuerySystemInformation
hal
KfReleaseSpinLock
HalMakeBeep
Sections
.text Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 640B - Virtual size: 628B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 230KB - Virtual size: 230KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 47KB - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 768B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ