Behavioral task
behavioral1
Sample
2b7bfdac052cca4c22d4c42067a6f2219763dfd4a81edd424aafb6c90f0a5f44.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2b7bfdac052cca4c22d4c42067a6f2219763dfd4a81edd424aafb6c90f0a5f44.exe
Resource
win10v2004-20220901-en
General
-
Target
2b7bfdac052cca4c22d4c42067a6f2219763dfd4a81edd424aafb6c90f0a5f44
-
Size
68KB
-
MD5
338dcb39d55c741b7c57e69a1509fb00
-
SHA1
74f4d6d0d9e569e958b2a07158936c21d7603e50
-
SHA256
2b7bfdac052cca4c22d4c42067a6f2219763dfd4a81edd424aafb6c90f0a5f44
-
SHA512
d26941809b28029493a8b0cfb0e6bb5bf24f2b2b6c18621ead4ff7fb8c984a88da327966e04704ccf57b4ada07092c7c0687e974e7b39ffb884254bfcaf9fd5e
-
SSDEEP
1536:sFy3liYx1QTmwVrjemxjHCfsw3kdZnjfvZpo7VUW/+:rE41/wVrjFx4ENfQV//+
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
2b7bfdac052cca4c22d4c42067a6f2219763dfd4a81edd424aafb6c90f0a5f44.exe windows x86
e080d14cccb842fd17a24425baa8374b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlInitAnsiString
IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
ExAllocatePool
ExFreePool
NtQuerySystemInformation
hal
HalMakeBeep
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 384B - Virtual size: 340B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 40B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 384B - Virtual size: 284B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 640B - Virtual size: 592B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 996B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ