Behavioral task
behavioral1
Sample
89e244e4ec16d62cc1f65f740981365d94833acec0e928d5bf27ee3f8009cc8f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
89e244e4ec16d62cc1f65f740981365d94833acec0e928d5bf27ee3f8009cc8f.exe
Resource
win10v2004-20221111-en
General
-
Target
89e244e4ec16d62cc1f65f740981365d94833acec0e928d5bf27ee3f8009cc8f
-
Size
681KB
-
MD5
9b43e0189eba6690d4a5c5e5fae4e0eb
-
SHA1
fd74f6494872d3fa910da204fe0f9dbde4cd1fc1
-
SHA256
89e244e4ec16d62cc1f65f740981365d94833acec0e928d5bf27ee3f8009cc8f
-
SHA512
774766f91bb89bcd80b730dea0331a11aea53ddf017bcc81e14123ab24a7c08b183f4efc7d30dd169134523a67f73b02c8695e968488cdd3570ab4a588428484
-
SSDEEP
12288:X9OOid7cj8+T6DL0+jtIgbq8MH3iH/HoxfNahU8493WV4L8pxewl3zs2W19ct:M748zP0+jy8MSH/HyOUVmV4GjNRW0t
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
89e244e4ec16d62cc1f65f740981365d94833acec0e928d5bf27ee3f8009cc8f.exe windows x86
85f61f5a0fcc34f9f4d95fdfc3392357
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwQueryInformationFile
IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
ExAllocatePool
ExFreePool
NtQuerySystemInformation
hal
KeGetCurrentIrql
HalMakeBeep
Sections
.text Size: - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 372B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 894B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 575KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 680KB - Virtual size: 679KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 188B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ