Behavioral task
behavioral1
Sample
0d91085f356df842be28a5cddb14945932c4452400cba54fc8e3865cbac7cb4d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0d91085f356df842be28a5cddb14945932c4452400cba54fc8e3865cbac7cb4d.exe
Resource
win10v2004-20220812-en
General
-
Target
0d91085f356df842be28a5cddb14945932c4452400cba54fc8e3865cbac7cb4d
-
Size
780KB
-
MD5
97d486919b2b9a7852fb495c8ef5e9bd
-
SHA1
0f8531259aac6d191da8459fa6d93a3dd0954049
-
SHA256
0d91085f356df842be28a5cddb14945932c4452400cba54fc8e3865cbac7cb4d
-
SHA512
2313c747d2c7aee95e812010158c9bc1a4c523f3346d6ee24b54aa5c9fad1914b1e2b6c108bf901f558ecfaac2f491422415358cb164849c224af7e53f6cb91e
-
SSDEEP
12288:ijNclZi156/LHGArtUg+HgWhl/l40NjKnr7LL5qYXExX2cgNtmAteu+X7Xi4eF:s4or6/LHX3yl/iUjKr7LJ0Z28lm4eF
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
0d91085f356df842be28a5cddb14945932c4452400cba54fc8e3865cbac7cb4d.exe windows x86
6f5533cda730453df88da22a41c3845a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasHangUpA
winmm
mixerGetLineInfoA
ws2_32
htons
kernel32
ReadFile
GetModuleHandleA
GetProcAddress
VirtualProtect
user32
GetPropA
MessageBoxA
gdi32
ExtSelectClipRgn
msimg32
GradientFill
winspool.drv
ClosePrinter
advapi32
RegQueryValueExA
shell32
SHGetSpecialFolderPathA
ole32
CreateILockBytesOnHGlobal
oleaut32
SafeArrayUnaccessData
comctl32
ImageList_GetIcon
oledlg
ord8
wininet
InternetOpenA
comdlg32
GetSaveFileNameA
Sections
.text Size: - Virtual size: 837KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 427KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 364KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 185KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 756KB - Virtual size: 752KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ