Behavioral task
behavioral1
Sample
d13d7ec96f4f7ad8b024d5018c06de34.exe
Resource
win7-20220812-en
General
-
Target
d13d7ec96f4f7ad8b024d5018c06de34.exe
-
Size
1.0MB
-
MD5
d13d7ec96f4f7ad8b024d5018c06de34
-
SHA1
e155f7daff40731e1e218f627e4ab48f36fb8314
-
SHA256
326fdf4522442f9bf2d93d495540f76dd00d623e5ad448a797eb7f8b329ea45e
-
SHA512
35009d4fed3354438d6f69789d5150e6271b615c8828221c1344447d0fdc66d5904c93ef57180cead8de9b9f32136a2bcb7b4b10cead54f96de9b5bfdc569ee6
-
SSDEEP
24576:etf3hBENnua4KhbDaK+787d/BoXVxmACTC70MhFPk:etPhBwrFbDgSdZEx7CTC70ch
Malware Config
Signatures
-
Processes:
resource yara_rule sample vmprotect
Files
-
d13d7ec96f4f7ad8b024d5018c06de34.exe.exe windows x86
06aead37fb27582d9f9e01ee5a4222a0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FreeEnvironmentStringsW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CharUpperBuffW
Sections
.data Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 70KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
New4 Size: - Virtual size: 512B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: - Virtual size: 378KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 964KB - Virtual size: 964KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 71KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ