Behavioral task
behavioral1
Sample
243b36975a1eb6fae457c09cfd964acac3f9b25fff627f9735184db7b557e5bd.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
243b36975a1eb6fae457c09cfd964acac3f9b25fff627f9735184db7b557e5bd.exe
Resource
win10v2004-20220812-en
General
-
Target
243b36975a1eb6fae457c09cfd964acac3f9b25fff627f9735184db7b557e5bd
-
Size
60KB
-
MD5
e4b791882eee916d09a7cf4c072b8cc7
-
SHA1
96a6fa44a9cd13cc2cdf84f93c11d90834ca0751
-
SHA256
243b36975a1eb6fae457c09cfd964acac3f9b25fff627f9735184db7b557e5bd
-
SHA512
59de8c6ff5e551acaa1ced76cd86c268925320d15edf5146f5392387f0a5a98886285fd5adf48c61944a29a396ed1707491332c8a30ce0a3539c66b6af3abf27
-
SSDEEP
1536:Vvr2gld2beNhnCxYw/UnXws30QCv609ErwUKbG:Fh2beNhnCD/lS0QCSvEUF
Malware Config
Signatures
-
Processes:
resource yara_rule sample vmprotect
Files
-
243b36975a1eb6fae457c09cfd964acac3f9b25fff627f9735184db7b557e5bd.exe windows x86
5ffae0b78389142c643d33f2d2e20ea8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateThread
GetModuleHandleA
GetProcAddress
VirtualProtect
user32
wsprintfA
MessageBoxA
advapi32
RegSetValueExA
ws2_32
send
Sections
.text Size: - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 52KB - Virtual size: 49KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 96B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ