Behavioral task
behavioral1
Sample
201dff29a4f0af7622877edd94b7466df8edff27006ae07d13f904c1d16843d0.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
201dff29a4f0af7622877edd94b7466df8edff27006ae07d13f904c1d16843d0.exe
Resource
win10v2004-20220812-en
General
-
Target
201dff29a4f0af7622877edd94b7466df8edff27006ae07d13f904c1d16843d0
-
Size
832KB
-
MD5
04c59aaf4aba5f89eb20de061d753fa0
-
SHA1
3905071076c4a2a4b5c33a1d4ca4a9e313470cbf
-
SHA256
201dff29a4f0af7622877edd94b7466df8edff27006ae07d13f904c1d16843d0
-
SHA512
0eabb7710621bdcbc1826390f06503a4ff07dbb1dd6fb4917f625a3a396787c207f70fc6dbd72f48610c70452bcb0984e74a63173c29dd8b32e1e80dcab97e9a
-
SSDEEP
24576:5C0laZTzaeV0ZwTfWhCpD2OkLdiYGhLgNxwJ7gN:5lwjVbmXpNNxw
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
201dff29a4f0af7622877edd94b7466df8edff27006ae07d13f904c1d16843d0.exe windows x86
ea44446ace5fcb23995f37392527167b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaAryLock
kernel32
EnumResourceTypesW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxW
Sections
.text Size: - Virtual size: 73KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 771KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 824KB - Virtual size: 820KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ