Behavioral task
behavioral1
Sample
6551d8d6c81370d8b194e192805e4d48184f6e80758ca56716b75c0bab0f25eb.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
6551d8d6c81370d8b194e192805e4d48184f6e80758ca56716b75c0bab0f25eb.exe
Resource
win10v2004-20220812-en
General
-
Target
6551d8d6c81370d8b194e192805e4d48184f6e80758ca56716b75c0bab0f25eb
-
Size
580KB
-
MD5
4b64790bc26b635813be3adc62342c64
-
SHA1
2671b9f3afe95486d915b2e222576e807605e2a5
-
SHA256
6551d8d6c81370d8b194e192805e4d48184f6e80758ca56716b75c0bab0f25eb
-
SHA512
6c76637894221fbdf6a69bbec1d18b0b53716dc3151dce98ca6ada9bb5f0738413c76f6c7f6d3d49c6af7fcab5199a893b098354eea89a01864d6ce5a1db3d27
-
SSDEEP
12288:iEsaTPJBd+j1FS5k/+EVVfji4ERRpRkQMpWrdKdsNHZcNL:ga72S50+EVV+4ERRpypOBh+B
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
6551d8d6c81370d8b194e192805e4d48184f6e80758ca56716b75c0bab0f25eb.exe windows x86
ea49f0f9813b3e6a36330988b8cd4eb4
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasHangUpA
kernel32
GetModuleHandleA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
SetClipboardData
MessageBoxA
gdi32
SetWindowOrgEx
winmm
midiStreamRestart
winspool.drv
OpenPrinterA
advapi32
RegCreateKeyExA
shell32
ShellExecuteA
ole32
CreateILockBytesOnHGlobal
oleaut32
SafeArrayUnaccessData
comctl32
ImageList_Destroy
oledlg
ord8
ws2_32
inet_ntoa
wininet
InternetCanonicalizeUrlA
comdlg32
GetOpenFileNameA
Sections
.text Size: - Virtual size: 555KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 235KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 171KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 560KB - Virtual size: 558KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ