Behavioral task
behavioral1
Sample
840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe
Resource
win10v2004-20221111-en
General
-
Target
840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067
-
Size
207KB
-
MD5
da990c92650cc9d76ec7551b83bf0b80
-
SHA1
35ea8708c240cd12d5e3dc275eef6434241bf4c9
-
SHA256
840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067
-
SHA512
78cd07c66bf5ef3086bd5daee5730e1434481947588f4717b3b35900e9b67842a47df42d078377387d4f71a5c89acd80f3a4a0630239e897858bc76325b719c8
-
SSDEEP
6144:NK7kA352xsl1hssGwGWlatbJ6GV+3/DVvWtU1k:2kAJ2xifBwFCNt
Malware Config
Signatures
-
Processes:
resource yara_rule sample vmprotect
Files
-
840bd4b0e47a5fc5561bae900310fff3d0df06765c611eee231296f700322067.exe windows x86
3fbad927aeb9f1ec50f749eaed9685f3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
user32
MessageBoxA
MessageBoxA
advapi32
ControlService
ntdll
NtCreateFile
kernel32
TlsAlloc
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
Sections
.text Size: - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 25KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 180KB - Virtual size: 179KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 104B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ