Behavioral task
behavioral1
Sample
0efe76d519e4e0ca5ee6175f0f2b2f55de852f5e4a0f4d90e5d803935de6281b.exe
Resource
win7-20221111-en
General
-
Target
0efe76d519e4e0ca5ee6175f0f2b2f55de852f5e4a0f4d90e5d803935de6281b
-
Size
5.3MB
-
MD5
0cee40a957d4d7cdd931e6ffa3f1cc3e
-
SHA1
7fcee605eae4e58d22573011bb8c1c356ae60021
-
SHA256
0efe76d519e4e0ca5ee6175f0f2b2f55de852f5e4a0f4d90e5d803935de6281b
-
SHA512
959e38948a870d4e8d885925636d2abf69328ce3bb74efa773d7f190fd6100bdf4fe4efda6f2c48d298d00c4f2da391ed18de1957bf51635c2eafe1a6e44b044
-
SSDEEP
98304:t1ly+LA79RFCTsyctUqInmyG96Tn7y4EuH6SxNBFa5JFYRsd6WfW6:t1lT8HFYsr/FJ96CtuHjNBEzYRT
Malware Config
Signatures
-
Processes:
resource yara_rule sample vmprotect
Files
-
0efe76d519e4e0ca5ee6175f0f2b2f55de852f5e4a0f4d90e5d803935de6281b.exe windows x86
9b04f7fb4425563525cf335f831b7208
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
vcruntime140
__current_exception_context
api-ms-win-crt-stdio-l1-1-0
getchar
api-ms-win-crt-string-l1-1-0
strcmp
api-ms-win-crt-runtime-l1-1-0
_exit
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
_set_new_mode
kernel32
GetSystemTimeAsFileTime
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Sections
.text Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.3MB - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ