Behavioral task
behavioral1
Sample
8b9c12dafc3e2b6f6ae09b415d3dfad134090bc3c6d5cc7cadae7a2fa92cea07.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8b9c12dafc3e2b6f6ae09b415d3dfad134090bc3c6d5cc7cadae7a2fa92cea07.exe
Resource
win10v2004-20220901-en
General
-
Target
8b9c12dafc3e2b6f6ae09b415d3dfad134090bc3c6d5cc7cadae7a2fa92cea07
-
Size
992KB
-
MD5
84dc2c02de91f11023484c5094c024d0
-
SHA1
a4d1e9577b1cb22d1a27068e4423e1da3717507d
-
SHA256
8b9c12dafc3e2b6f6ae09b415d3dfad134090bc3c6d5cc7cadae7a2fa92cea07
-
SHA512
ab49768c8058429f6bdf1e7380198006cc6b1417bea763215c66bc3ea5c077c12e141de46e42eabad72556f3fb68394f94e171a80cee9a9e0d4e1b8788a18042
-
SSDEEP
24576:yWSbRXAjKFlg22XUCwEoysrf+U9ObSrNsb3FOZcIP:cboKQPkCTGrNsbU
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
8b9c12dafc3e2b6f6ae09b415d3dfad134090bc3c6d5cc7cadae7a2fa92cea07.exe windows x86
deec4a680b9740f31cfe79c61427d645
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiOutPrepareHeader
ws2_32
shutdown
rasapi32
RasGetConnectStatusA
kernel32
GetVersionExA
GetVersion
DuplicateHandle
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetScrollRange
gdi32
RestoreDC
winspool.drv
ClosePrinter
advapi32
RegOpenKeyExA
shell32
Shell_NotifyIconA
ole32
OleIsCurrentClipboard
oleaut32
VariantChangeType
comctl32
ord17
oledlg
ord8
wininet
HttpOpenRequestA
comdlg32
GetSaveFileNameA
Sections
.text Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 444KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 361KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
jfjhgky Size: - Virtual size: 91B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 984KB - Virtual size: 982KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE