Behavioral task
behavioral1
Sample
92fd10536abf468ab0ab46895664e5f89d89224d0193695455b4d49e9ca4f954.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
92fd10536abf468ab0ab46895664e5f89d89224d0193695455b4d49e9ca4f954.exe
Resource
win10v2004-20220812-en
General
-
Target
92fd10536abf468ab0ab46895664e5f89d89224d0193695455b4d49e9ca4f954
-
Size
4.8MB
-
MD5
bd7b15c510d0db0ec9baa602e4a0a634
-
SHA1
26bd05345bb3290ce55ae3b85fec8b1de5736116
-
SHA256
92fd10536abf468ab0ab46895664e5f89d89224d0193695455b4d49e9ca4f954
-
SHA512
a9e40452a4e7b99746fd251343f2847ae06a58a27316008183897a5b312ee361224a609bd7f4a596a574f3b026a0d117bc5ba869ee2814a8cf1802576c5c41c9
-
SSDEEP
1536:M3dgFymqgO+xhw1hsMlGH0y4UU/MmuuwvbLyl9WqdPgi6lPDGle2ZMCC9xCaXCCK:M3JQO5hsMcHF8mvbaPgi6l7j2ZMC8K
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
92fd10536abf468ab0ab46895664e5f89d89224d0193695455b4d49e9ca4f954.exe windows x86
791f421b7004cf27f33dbe5d800b3e19
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord389
msvcrt
_onexit
kernel32
FindClose
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
OpenDesktopA
MessageBoxA
shell32
SHGetSpecialFolderPathA
psapi
EnumProcessModules
Sections
.text Size: - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 920B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 79KB - Virtual size: 78KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 168B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ