Behavioral task
behavioral1
Sample
2d68c4975ca143fcf848b3152d82cb65dbaf4f88133a8d576b1d975357af4210.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2d68c4975ca143fcf848b3152d82cb65dbaf4f88133a8d576b1d975357af4210.exe
Resource
win10v2004-20220812-en
General
-
Target
2d68c4975ca143fcf848b3152d82cb65dbaf4f88133a8d576b1d975357af4210
-
Size
5.0MB
-
MD5
66e7c1f98bd1c8e8906fbb9bdd00d9bd
-
SHA1
2eac12fe60f5045e8561ac742a8bdbe9c7b67b08
-
SHA256
2d68c4975ca143fcf848b3152d82cb65dbaf4f88133a8d576b1d975357af4210
-
SHA512
0227f57f3acdd5e2414ebc1858ce121354599f6371bf0df7aa0065dd49f733e880e0aaff94c45783e101314c677ea404d3451b6ec38ddc5c9cd51712cd692fcb
-
SSDEEP
98304:r20l2jw2/tBtrVRHTnBtIofKveEOFXTpY+Ui6cG7Ay3tQyIgljcf:n8/DtBJAofKvepXTQtvIPf
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
2d68c4975ca143fcf848b3152d82cb65dbaf4f88133a8d576b1d975357af4210.exe windows x86
b15c43b78de95bb87814f5f8604e8958
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
GetClassNameA
kernel32
GetVersionExA
GetVersion
GetVersionExA
GetVersion
FileTimeToLocalFileTime
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
GetROP2
ole32
OleFlushClipboard
gdiplus
GdipGetImageGraphicsContext
imm32
ImmGetContext
shell32
SHAppBarMessage
winspool.drv
DocumentPropertiesA
advapi32
RegSetValueExA
comctl32
ImageList_Destroy
shlwapi
PathFileExistsA
winmm
midiStreamOpen
oleaut32
SafeArrayGetDim
oledlg
ord8
ws2_32
accept
comdlg32
GetSaveFileNameA
Sections
.text Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 751KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 5.0MB - Virtual size: 5.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ