Behavioral task
behavioral1
Sample
cfed710327d0e449e8a24c7e20c05c5babf5069d87cd75ab93ee88fe3a9bd30b.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cfed710327d0e449e8a24c7e20c05c5babf5069d87cd75ab93ee88fe3a9bd30b.dll
Resource
win10v2004-20220812-en
General
-
Target
cfed710327d0e449e8a24c7e20c05c5babf5069d87cd75ab93ee88fe3a9bd30b
-
Size
40KB
-
MD5
68ba15b7f310d04d2e702f7cd18bc344
-
SHA1
30c23475d08c880fbb1c7af91923ba17745a2dd8
-
SHA256
cfed710327d0e449e8a24c7e20c05c5babf5069d87cd75ab93ee88fe3a9bd30b
-
SHA512
a2bd2373ccef30a2bdb2975314739197d57b4e1ea992efba107388b2a2362427392eb90fbc3f6a5e7df9f141636b0392ecd47537a6130f1be840db6ef17765b2
-
SSDEEP
768:PiDoesTZ/44rmMXXpDvUPWc5xrI7GMBkifjaGf9zuSuI:PhTa4rmIF8PWsxrkhJf/f71
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
cfed710327d0e449e8a24c7e20c05c5babf5069d87cd75ab93ee88fe3a9bd30b.dll windows x86
086a27f45bc2e43b28c0fd29c55f029f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentProcessId
DisableThreadLibraryCalls
VirtualProtect
user32
GetParent
SetWindowLongA
RegisterWindowMessageA
CallWindowProcA
SendMessageA
GetWindowThreadProcessId
GetClassNameA
EnumWindows
msvcrt
_adjust_fdiv
malloc
_initterm
free
_except_handler3
Sections
.text Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 614B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 294B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 32KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 104B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ