Behavioral task
behavioral1
Sample
3216fb42e410628282217b865e93fa68aaedae52c9720d2ef7f5d967a57ee61f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3216fb42e410628282217b865e93fa68aaedae52c9720d2ef7f5d967a57ee61f.exe
Resource
win10v2004-20220812-en
General
-
Target
3216fb42e410628282217b865e93fa68aaedae52c9720d2ef7f5d967a57ee61f
-
Size
11.4MB
-
MD5
4ca2b92346da55dabbc66eda9a767afc
-
SHA1
4dd740230a289742aae8d12602f797bd36ec12dc
-
SHA256
3216fb42e410628282217b865e93fa68aaedae52c9720d2ef7f5d967a57ee61f
-
SHA512
66a5144487cc342064e324bfab3951e1fbf586359d44ad68447aa4d23d1bb621ca1311fabb4c6170ee95c6de1b59e98745a33b0d71dfe7a8e2645ac9a8d54f34
-
SSDEEP
196608:CEgpi+gAopuROmoWrJe1cmk+At/DnNshvgcwAiRF5iwV:CEgpi+gAGoqWgcmkd/DNs5gDf4
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
3216fb42e410628282217b865e93fa68aaedae52c9720d2ef7f5d967a57ee61f.exe windows x86
c3a615eeca082fd9539ce2968f4bd813
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutWrite
ws2_32
closesocket
version
VerQueryValueA
kernel32
WritePrivateProfileStringA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
IsChild
MessageBoxA
gdi32
DPtoLP
winspool.drv
DocumentPropertiesA
advapi32
RegCreateKeyA
shell32
Shell_NotifyIconA
ole32
OleUninitialize
oleaut32
RegisterTypeLi
comctl32
ord17
wldap32
ord29
comdlg32
ChooseFontA
Sections
.text Size: 812KB - Virtual size: 808KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9.1MB - Virtual size: 9.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 68KB - Virtual size: 232KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 108KB - Virtual size: 106KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE