Behavioral task
behavioral1
Sample
f625e1370733fba0d8f8c19d6f7b80b60de58835421ae258af796c6cda880b76.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f625e1370733fba0d8f8c19d6f7b80b60de58835421ae258af796c6cda880b76.exe
Resource
win10v2004-20220812-en
General
-
Target
f625e1370733fba0d8f8c19d6f7b80b60de58835421ae258af796c6cda880b76
-
Size
304KB
-
MD5
0a192d619f4fbf255bfa2e6e7abd2cc0
-
SHA1
267e7a1491953511f35d71f2c2cf4c1de0b2187d
-
SHA256
f625e1370733fba0d8f8c19d6f7b80b60de58835421ae258af796c6cda880b76
-
SHA512
00b8e4ac5957622c153b14bfb601478c084b13783cca9d769c52c6a2a04cc91dc6dd4eaabc8aed4f9ef4842d4789507a5fd690e228ed05c13c2f1a700c67d437
-
SSDEEP
6144:T+HW63l2X43/WuoOqxOcPungG4M7RIe8vZ6CP1w8u2cR8Zuogzsv0buWsPk:+2X4+Rr8rgGl1Ie8vZ3P1w8+R8kogxyc
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
f625e1370733fba0d8f8c19d6f7b80b60de58835421ae258af796c6cda880b76.exe windows x86
118fe0576b5569e01c6501bde2a478c1
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
KeBugCheckEx
IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
ExAllocatePool
ExFreePool
NtQuerySystemInformation
hal
KeGetCurrentIrql
HalMakeBeep
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 640B - Virtual size: 628B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 211KB - Virtual size: 211KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 47KB - Virtual size: 46KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 896B - Virtual size: 892B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ