Behavioral task
behavioral1
Sample
9429cf18bd12076a7761d98ba065c7e877a5af6a2c8449b430321720e6097ebb.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
9429cf18bd12076a7761d98ba065c7e877a5af6a2c8449b430321720e6097ebb.exe
Resource
win10v2004-20220812-en
General
-
Target
9429cf18bd12076a7761d98ba065c7e877a5af6a2c8449b430321720e6097ebb
-
Size
661KB
-
MD5
e398c83fef16fa50fcb69e90817e006d
-
SHA1
e68a2d7e4a26f94da8566c494c6dc8cc3f1baafa
-
SHA256
9429cf18bd12076a7761d98ba065c7e877a5af6a2c8449b430321720e6097ebb
-
SHA512
436f770ff958fe781de3fb3723255068e67fc4818ab3550d270eab98eac0ecfcabcc15615041514ea0ce0178bef9846603b95f830db347a6e16f4df42d251c50
-
SSDEEP
12288:zvarwsU4+L1GXl1gAT86MU99HKUTzzOyBUqTUkrfmSciCltaSdl+20gX:zvasE+L81yAwQzbDNBDL52Uyl
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
9429cf18bd12076a7761d98ba065c7e877a5af6a2c8449b430321720e6097ebb.exe windows x86
94539c4fcf477bd0ef379a2e923983f2
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
KeInitializeSpinLock
IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
ExAllocatePool
ExFreePool
NtQuerySystemInformation
hal
KfRaiseIrql
HalMakeBeep
Sections
.text Size: - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 372B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 894B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 563KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 660KB - Virtual size: 659KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ