Behavioral task
behavioral1
Sample
350b8f96d63f6258919c583985b5a3d603b98859a359e1b3844f928e185e56da.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
350b8f96d63f6258919c583985b5a3d603b98859a359e1b3844f928e185e56da.exe
Resource
win10v2004-20220812-en
General
-
Target
350b8f96d63f6258919c583985b5a3d603b98859a359e1b3844f928e185e56da
-
Size
1.4MB
-
MD5
5baa9158268baf72cff4b6680f6b6f15
-
SHA1
31dc9d7e1b2a40b69973709e14ff96575648915e
-
SHA256
350b8f96d63f6258919c583985b5a3d603b98859a359e1b3844f928e185e56da
-
SHA512
cd0fc497ee8632263ed0f54150e766a88109fd5e226c6353b1b478ebc5c7b30a0282cfe4bb8357696c16dec6cada05f287322d4ae720ff88f5e3dbd5b9f506d9
-
SSDEEP
24576:QlbJbJRM9+zDmidLD8/xK7tHyQNBBeOs/k580WAwY9UymmLU7Gd4E4:Qlb6Im8ogtyQLIB4qTBG2E4
Malware Config
Signatures
-
Processes:
resource yara_rule sample vmprotect
Files
-
350b8f96d63f6258919c583985b5a3d603b98859a359e1b3844f928e185e56da.exe windows x86
6380518e081ac0a4f4e08d84e71ca6fb
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rpcrt4
UuidToStringA
kernel32
GetSystemTime
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
LoadCursorA
gdi32
SetTextColor
winmm
waveOutPrepareHeader
winspool.drv
OpenPrinterA
advapi32
RegCreateKeyExA
shell32
ShellExecuteA
ole32
StgOpenStorageOnILockBytes
oleaut32
VariantCopy
comctl32
ord17
oledlg
ord8
ws2_32
WSAAsyncSelect
comdlg32
ChooseColorA
Sections
.text Size: - Virtual size: 554KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 176KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ