Behavioral task
behavioral1
Sample
88fd7486e19fa14f9a76ec456ce4ac8edc8349b5d965110241a78e5798f67a3c.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
88fd7486e19fa14f9a76ec456ce4ac8edc8349b5d965110241a78e5798f67a3c.exe
Resource
win10v2004-20220812-en
General
-
Target
88fd7486e19fa14f9a76ec456ce4ac8edc8349b5d965110241a78e5798f67a3c
-
Size
650KB
-
MD5
5f06fa3ac1b05073e0f3e6a6bbadae87
-
SHA1
947a1da8849bfd9897bedf8ea9f8ff850bd10a84
-
SHA256
88fd7486e19fa14f9a76ec456ce4ac8edc8349b5d965110241a78e5798f67a3c
-
SHA512
0929a09ccdefb1df7b59c75f1009e6cfdd974fa57cd8975bb2f14dad5bd43f0b3b29ea509225908e607f1efbf4c380fed9227f4739ff98598a45ccf992755c47
-
SSDEEP
12288:YlzQMrfOs05SDuACEv/837u14TaHOASAxb6JZS0TB3QXsFHHSuQY2nUW9G/:YlzR9Rbvl4ALz5CZSoBysFSuQD7Y
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
88fd7486e19fa14f9a76ec456ce4ac8edc8349b5d965110241a78e5798f67a3c.exe windows x86
88abd452a6d1252274e54a0dac03eec6
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlAppendUnicodeToString
IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
ExAllocatePool
ExFreePool
NtQuerySystemInformation
hal
KeGetCurrentIrql
HalMakeBeep
Sections
.text Size: - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 372B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 894B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 545KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 649KB - Virtual size: 649KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 300B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ