Behavioral task
behavioral1
Sample
7f1bfb5668cecd15b5499373ff48b18994c4ba27b14c32e5f0b52a948647cd3e.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
7f1bfb5668cecd15b5499373ff48b18994c4ba27b14c32e5f0b52a948647cd3e.exe
Resource
win10v2004-20221111-en
General
-
Target
7f1bfb5668cecd15b5499373ff48b18994c4ba27b14c32e5f0b52a948647cd3e
-
Size
803KB
-
MD5
11c4ee255b1500c79d44a3e0f34e9401
-
SHA1
a368f53f5696d2cf4e486957aaf9de37fc30023d
-
SHA256
7f1bfb5668cecd15b5499373ff48b18994c4ba27b14c32e5f0b52a948647cd3e
-
SHA512
0b43b6529a3c4bc2874e2eef0f293e54bb1951643fa47e2e3967f1b3b804386833b2798e6a5494ec64ac99b257bebb2a2af59d4c3a8c656259fb85b40fda680d
-
SSDEEP
24576:in5BbgLei/ta9GBCXxi0VuITPITJ/+XW5g:i5hwez1s0VuILuJuW5
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
7f1bfb5668cecd15b5499373ff48b18994c4ba27b14c32e5f0b52a948647cd3e.exe windows x86
45e711b2cca01f713ee665f1ce0dfe41
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Process32Next
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetWindowTextA
MessageBoxA
advapi32
LookupPrivilegeValueA
ole32
CoUninitialize
shlwapi
PathFileExistsA
Sections
.text Size: - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 643KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 781KB - Virtual size: 780KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 232B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.erdata Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE