ServiceMain
Behavioral task
behavioral1
Sample
ef9edf49041a07136216a3163ed9bbbfd091a61cf95b811a6f7c7785caab51d7.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ef9edf49041a07136216a3163ed9bbbfd091a61cf95b811a6f7c7785caab51d7.dll
Resource
win10v2004-20220812-en
General
-
Target
ef9edf49041a07136216a3163ed9bbbfd091a61cf95b811a6f7c7785caab51d7
-
Size
140KB
-
MD5
6fda2b08a7b3c236a79212cb9c07cdd0
-
SHA1
9d91a897e950c8aa66c09f3bad01064c82364b3c
-
SHA256
ef9edf49041a07136216a3163ed9bbbfd091a61cf95b811a6f7c7785caab51d7
-
SHA512
68929812382dd6edf9661e6c56839fa1ba76855a9f84b0e139d41428b8b30e9626133059b5cd7b8397101c33e62b94b9b56f35756f05d445ffc78ebf5f4eb448
-
SSDEEP
3072:+b4s/l8iiDXiYukRy9Vd746gh4Z91gCBzTz4y3/UHj7Nzspl+fXi:+B/l0Xi3uyJ7Mhy9dx3s3fy
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
ef9edf49041a07136216a3163ed9bbbfd091a61cf95b811a6f7c7785caab51d7.dll windows x86
60ef5f42db52439cb93f5733f5b7ae89
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
strchr
memset
atoi
strcspn
srand
memcpy
strtoul
strncpy
rand
strstr
kernel32
CreateFileA
lstrcatA
GetTempPathA
GetModuleFileNameA
LocalFree
LocalAlloc
InterlockedIncrement
InterlockedDecrement
lstrlenA
CreateProcessA
SetErrorMode
CreateThread
GlobalMemoryStatusEx
WaitForSingleObject
InterlockedExchange
CopyFileA
TerminateProcess
DisconnectNamedPipe
ReadFile
ConnectNamedPipe
CreateNamedPipeA
GetModuleHandleA
SetFilePointer
GetWindowsDirectoryA
DeleteFileA
InterlockedExchangeAdd
GetCurrentThreadId
WriteFile
CloseHandle
LoadLibraryA
GetProcAddress
ExitProcess
GetTickCount
GetThreadTimes
GetSystemInfo
Sleep
VirtualProtect
ExitProcess
user32
wsprintfA
advapi32
StartServiceA
CreateServiceA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegisterServiceCtrlHandlerA
SetServiceStatus
OpenSCManagerA
CloseServiceHandle
OpenServiceA
ole32
CoInitializeEx
ws2_32
ntohl
WSASocketA
htonl
WSAStartup
WSAIoctl
setsockopt
socket
sendto
send
select
WSAGetLastError
connect
ioctlsocket
htons
recvfrom
recv
closesocket
gethostbyname
inet_addr
dnsapi
DnsQuery_A
DnsQueryConfig
iphlpapi
GetAdaptersAddresses
GetBestRoute
GetIfTable
Exports
Exports
Sections
.text Size: - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 138KB - Virtual size: 137KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 120B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ