Behavioral task
behavioral1
Sample
fce58603d18b169d67fee4a3df7d39757a4126716703840acfe8cfb5e34990e9.exe
Resource
win7-20221111-en
General
-
Target
fce58603d18b169d67fee4a3df7d39757a4126716703840acfe8cfb5e34990e9
-
Size
688KB
-
MD5
b2e12c662badc96d34a096f48db2d85c
-
SHA1
d6d99f90c0dd1a56a1285532254a1c92a6024077
-
SHA256
fce58603d18b169d67fee4a3df7d39757a4126716703840acfe8cfb5e34990e9
-
SHA512
52815a032f3f88758098757fe18bf575423f481a6e58586fc5f80105cce4d367373913516c802decb225e92b2fb0bf3c130163dc2e75d15b4239a16001dbde92
-
SSDEEP
12288:Q8pU1gjXtuyO5lwwP5JuPi4k57It16nP0jaogTF4mFvnnkWTVb5VedvRoqr+In3/:Q8pUcU98wD6uIp2tL/35bLLRQ/
Malware Config
Signatures
-
Processes:
resource yara_rule sample vmprotect
Files
-
fce58603d18b169d67fee4a3df7d39757a4126716703840acfe8cfb5e34990e9.exe windows x86
ba5543cbfe347651175bd4a2f0417104
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
wsprintfA
MessageBoxA
GetActiveWindow
MessageBoxA
kernel32
HeapAlloc
LoadLibraryA
FreeLibrary
IsBadReadPtr
lstrcpyn
RtlMoveMemory
GetVersion
GetModuleHandleA
GetProcAddress
GetCurrentProcess
IsWow64Process
GetProcessHeap
ExitProcess
HeapFree
VirtualProtect
GetModuleFileNameA
ExitProcess
shell32
ShellExecuteA
msvcrt
strchr
atoi
strncmp
strncpy
Sections
.text Size: - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 676B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp1 Size: 662KB - Virtual size: 662KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 52B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ