Behavioral task
behavioral1
Sample
d5b003528ad4ea65d4df1745bf7c9d129fc3d423a30ec25b1f632d6f86326595.exe
Resource
win7-20220812-en
General
-
Target
d5b003528ad4ea65d4df1745bf7c9d129fc3d423a30ec25b1f632d6f86326595
-
Size
1020KB
-
MD5
3d0534168d885041749451c46f645cae
-
SHA1
339efbb2cf118137686beaa971655bffc8bb84ca
-
SHA256
d5b003528ad4ea65d4df1745bf7c9d129fc3d423a30ec25b1f632d6f86326595
-
SHA512
5172b6a60349c36a5cf43440610afd8049b9be6772ac5747e89abc18f357692d09c74f9834d21c8acb45234767f8718b473b2bfd0ab1f94f0cf4ed68ef9b0099
-
SSDEEP
24576:OaomoGm3WsvVE6+Gs3G9JTiSku3ywKCqZ6LBfQox:OaNoGmhT+G9ufmKdZ6940
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
d5b003528ad4ea65d4df1745bf7c9d129fc3d423a30ec25b1f632d6f86326595.exe windows x86
e5b0cfb0e8ced86a5f63f4d823cce9b4
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasHangUpA
kernel32
GetModuleHandleA
GetModuleHandleA
GetProcAddress
VirtualProtect
user32
SetClipboardData
MessageBoxA
gdi32
SetWindowOrgEx
winmm
midiStreamRestart
winspool.drv
OpenPrinterA
advapi32
RegCreateKeyExA
shell32
ShellExecuteA
ole32
CreateILockBytesOnHGlobal
oleaut32
SafeArrayUnaccessData
comctl32
ImageList_Destroy
oledlg
ord8
ws2_32
inet_ntoa
wininet
InternetCanonicalizeUrlA
comdlg32
GetOpenFileNameA
Sections
.text Size: - Virtual size: 491KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 223KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 135KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 996KB - Virtual size: 994KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 120B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ