RunDllHostCallBack
Behavioral task
behavioral1
Sample
ed39b66381a4a579e2e9291622f5dbd3905e8ca9b937a787963bdbae1e0b2221.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ed39b66381a4a579e2e9291622f5dbd3905e8ca9b937a787963bdbae1e0b2221.dll
Resource
win10v2004-20220812-en
General
-
Target
ed39b66381a4a579e2e9291622f5dbd3905e8ca9b937a787963bdbae1e0b2221
-
Size
872KB
-
MD5
301886a56855230d79e73946536d3b77
-
SHA1
7f9e27cc039c0e6ca9300c2fb47c5f03215702e3
-
SHA256
ed39b66381a4a579e2e9291622f5dbd3905e8ca9b937a787963bdbae1e0b2221
-
SHA512
4817e52dd7ee35588324ed81b0fee294f072270682940cd8e2c52cc1a5385d664b90baee69dab06c50c6f4a5f0dc4f212b7ad760597c215eb01ee0dcc0c3b6c6
-
SSDEEP
24576:KOqVah3T9d6nj3yJcqM7Lnv6TT7K6/XgJ9bRtx/nS11jcpz:7Uah3Zd6nx7LnCTK39bLxvGwz
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
ed39b66381a4a579e2e9291622f5dbd3905e8ca9b937a787963bdbae1e0b2221.dll windows x86
757bf702fac2e611c416af4f8764b4fe
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiOutPrepareHeader
ws2_32
ioctlsocket
kernel32
lstrcmpiA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetMenuItemID
MessageBoxA
gdi32
CreateHatchBrush
winspool.drv
DocumentPropertiesA
advapi32
RegCreateKeyExA
shell32
Shell_NotifyIconA
ole32
OleInitialize
oleaut32
RegisterTypeLi
comctl32
ord17
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 510KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 236KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 81KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 510KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 856KB - Virtual size: 854KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ