Behavioral task
behavioral1
Sample
dc5b4ec96a672f817755502602908e0b15db7811cf233a840415ff2736e14be3.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
dc5b4ec96a672f817755502602908e0b15db7811cf233a840415ff2736e14be3.exe
Resource
win10v2004-20220812-en
General
-
Target
dc5b4ec96a672f817755502602908e0b15db7811cf233a840415ff2736e14be3
-
Size
71KB
-
MD5
12249bf6c9eac0161928135a74058ba0
-
SHA1
519bb765ce57d74e020c538be3b93f32692123e6
-
SHA256
dc5b4ec96a672f817755502602908e0b15db7811cf233a840415ff2736e14be3
-
SHA512
23992c3714c33f4eb35e7b7b2ebf98de5ebf4de60a9cfe424d834e4402d4c4e06d806ab57b4c0f858f8e27ed74090cd0935fd15b3ce63a824777b9feec398c70
-
SSDEEP
1536:fhS6E8xicaNA+rsH5WAzGeSlIV8BAR2H+n63VtTKXzgJSbEL:ZK80cR15l8lIV8CR2H+k/TKXzM0q
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
dc5b4ec96a672f817755502602908e0b15db7811cf233a840415ff2736e14be3.exe windows x86
47842f5545bad8424a3d67829d33315e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlAnsiStringToUnicodeString
IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
ExAllocatePool
ExFreePool
NtQuerySystemInformation
hal
HalMakeBeep
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 384B - Virtual size: 340B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 40B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 384B - Virtual size: 284B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 640B - Virtual size: 580B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 996B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ