Behavioral task
behavioral1
Sample
13d5544a2a6c121992e5914ac2655ef08c86e1acb6e610813119f9ee2f973a79.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
13d5544a2a6c121992e5914ac2655ef08c86e1acb6e610813119f9ee2f973a79.dll
Resource
win10v2004-20220812-en
General
-
Target
13d5544a2a6c121992e5914ac2655ef08c86e1acb6e610813119f9ee2f973a79
-
Size
587KB
-
MD5
caf7fd651d91f6886e42bce149983f5c
-
SHA1
10545e8990700bc312382488fb6ecc4e5b010f88
-
SHA256
13d5544a2a6c121992e5914ac2655ef08c86e1acb6e610813119f9ee2f973a79
-
SHA512
5bd127d3b2fd8ccc712882a1ae767220264de5350b6f9c39fdd98bc914ca3f8060ee012da2e1679f624a93f473cf20ac0c64f0752c6b5d6846168d1873bb54dd
-
SSDEEP
12288:tYh4FnN+WqhTP5lv511iLibNfiLIfjE1+Dz9wYTr:tYh4FnN+Wc9DiW6/cDz9D
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
13d5544a2a6c121992e5914ac2655ef08c86e1acb6e610813119f9ee2f973a79.dll windows x86
2f9806b3a0f4cf93386c6f0cec1f7e2a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
InterlockedCompareExchange
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetWindowTextA
advapi32
GetCurrentHwProfileA
shell32
ShellExecuteA
msvcp90
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
wininet
DeleteUrlCacheEntry
iphlpapi
GetAdaptersInfo
shlwapi
PathFileExistsA
msvcr90
_initterm
Sections
.text Size: - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 680KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: - Virtual size: 45KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 391KB - Virtual size: 391KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 332B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 193KB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ