Behavioral task
behavioral1
Sample
67f1cbb9ef433ae5eb3a82bfdaec95dc004fe67c70d5b868595a87854152e0cc.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
67f1cbb9ef433ae5eb3a82bfdaec95dc004fe67c70d5b868595a87854152e0cc.dll
Resource
win10v2004-20220901-en
General
-
Target
67f1cbb9ef433ae5eb3a82bfdaec95dc004fe67c70d5b868595a87854152e0cc
-
Size
152KB
-
MD5
730e1bae5abc4c84efe9e31f122fa770
-
SHA1
90872124f4f558f7a27c8ee8702e9c1cf13bed2a
-
SHA256
67f1cbb9ef433ae5eb3a82bfdaec95dc004fe67c70d5b868595a87854152e0cc
-
SHA512
f4834e21e5543eb2543e90880708d079e2e32d9f40329e87d58f0810c0e5861b4073651fc8bcbc31780fa28b31ea22449d25610b7791dd46f1b1b94ceda39111
-
SSDEEP
3072:3XPNpJshvL+6nZ78rei5TicK69CsAvtPChF6qrUnYQeSF+:vH6vL+Ne7cjAvtPY6qrUnWSg
Malware Config
Signatures
-
Processes:
resource yara_rule sample vmprotect
Files
-
67f1cbb9ef433ae5eb3a82bfdaec95dc004fe67c70d5b868595a87854152e0cc.dll windows x86
0c64e8d0635dbd047be56012a4d28cb8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
InterlockedExchange
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetCursorPos
advapi32
RegQueryValueExA
Sections
.text Size: - Virtual size: 136KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sxdata Size: - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 144KB - Virtual size: 141KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 132B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ