Behavioral task
behavioral1
Sample
95bb00b7d8c2a574b1b1ef8463798285f9c3250adc8cc88b083ddbadd0b94192.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
95bb00b7d8c2a574b1b1ef8463798285f9c3250adc8cc88b083ddbadd0b94192.exe
Resource
win10v2004-20220901-en
General
-
Target
95bb00b7d8c2a574b1b1ef8463798285f9c3250adc8cc88b083ddbadd0b94192
-
Size
882KB
-
MD5
f16d87ca6201909cae04a73c0b977f91
-
SHA1
8bcc60232322cfac3914c8e3ffaf57bb0d55383e
-
SHA256
95bb00b7d8c2a574b1b1ef8463798285f9c3250adc8cc88b083ddbadd0b94192
-
SHA512
7e5004ee6fd1b78bc9c261b467971044d0da69e32dc7c5ea93ed9fff2998ab44fb84df09fd0191906e09a091a65fe71a52b1d017d6d8b6a65197d70fd608895d
-
SSDEEP
24576:Sat9uUX6euQt6TniOw2WwXmDwOxzN04Dg:SafucuQYHw2PXXgN
Malware Config
Signatures
-
Processes:
resource yara_rule sample vmprotect
Files
-
95bb00b7d8c2a574b1b1ef8463798285f9c3250adc8cc88b083ddbadd0b94192.exe windows x86
d1c4f968d79d8b78345c7603cbef07cf
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
KeTickCount
KeQueryTimeIncrement
KeWaitForSingleObject
_allmul
ZwClose
IoGetCurrentProcess
ObfDereferenceObject
PsGetVersion
KeUnstackDetachProcess
KeStackAttachProcess
PsLookupProcessByProcessId
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
RtlAppendUnicodeToString
memcpy
wcslen
ExFreePoolWithTag
IoDeleteSymbolicLink
RtlFreeUnicodeString
KeSetEvent
RtlAnsiStringToUnicodeString
RtlInitAnsiString
_except_handler3
IofCompleteRequest
RtlAssert
ExAllocatePool
ZwQuerySystemInformation
RtlCompareString
strncpy
strlen
MmGetSystemRoutineAddress
RtlInitUnicodeString
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwCreateSection
ZwCreateFile
ExAllocatePoolWithTag
strcpy
ZwReadFile
ZwQueryInformationFile
KefAcquireSpinLockAtDpcLevel
KefReleaseSpinLockFromDpcLevel
KeInitializeEvent
PsCreateSystemThread
RtlAppendUnicodeStringToString
memset
IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
ExAllocatePool
ExFreePool
NtQuerySystemInformation
hal
KfLowerIrql
KfRaiseIrql
KfAcquireSpinLock
KfReleaseSpinLock
KeGetCurrentIrql
HalMakeBeep
Sections
.text Size: - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 356B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 974B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 776KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 881KB - Virtual size: 880KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 304B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ