Behavioral task
behavioral1
Sample
e18cc6d5fa5ae439e38f9aa5a8e414e434fa9a0199ecc781df3662a3764268da.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
e18cc6d5fa5ae439e38f9aa5a8e414e434fa9a0199ecc781df3662a3764268da.dll
Resource
win10v2004-20220812-en
General
-
Target
e18cc6d5fa5ae439e38f9aa5a8e414e434fa9a0199ecc781df3662a3764268da
-
Size
48KB
-
MD5
9463be1c944b5ca3fa2ebc3a772d1981
-
SHA1
07f1e2bbb3c782e0428ff4f432a097a29c9f856e
-
SHA256
e18cc6d5fa5ae439e38f9aa5a8e414e434fa9a0199ecc781df3662a3764268da
-
SHA512
f9740f972bfbc50d2c336940d0b96662f74a07c95211a3ce20206a85b77f242a58b1363dcf5868c6e7e059024dae62c680de72f59bbdd288f850ed56260709b4
-
SSDEEP
768:TplJFsLFGVz7WBruWvaEbNQUZWf05ByD7MTh77knLYZTaSw7AT0rC5Dy:VlCworHJNhFB+IX0LIa77AwrC5Dy
Malware Config
Signatures
-
Processes:
resource yara_rule sample vmprotect
Files
-
e18cc6d5fa5ae439e38f9aa5a8e414e434fa9a0199ecc781df3662a3764268da.dll windows x86
e0ad0cb763ac1e27fffd432f85a3c572
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
MessageBoxA
kernel32
GetProcAddress
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Sections
.text Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 313B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 537B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 334B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp2 Size: 46KB - Virtual size: 46KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 60B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ