Behavioral task
behavioral1
Sample
1dd94a6a09ece96754e43af3611cdf69c5d0c73079b9c7a5974f85136d81e04d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1dd94a6a09ece96754e43af3611cdf69c5d0c73079b9c7a5974f85136d81e04d.exe
Resource
win10v2004-20220901-en
General
-
Target
1dd94a6a09ece96754e43af3611cdf69c5d0c73079b9c7a5974f85136d81e04d
-
Size
760KB
-
MD5
8e4fa7a20abaada499bd312ea4345fcd
-
SHA1
e43c3b9d004e395169b244c877b6866f36c0dc56
-
SHA256
1dd94a6a09ece96754e43af3611cdf69c5d0c73079b9c7a5974f85136d81e04d
-
SHA512
df4695d82b779a5271c77d6f11f58478225dc60f622945c2a40dc981b15928f902b537854dd39bee49882ae15d4334872e797ddf43ff3b0af1573b9a5c849b47
-
SSDEEP
12288:0CDtG1iB3SSMtK1n/+GZxSE26hAdIr7fpCe0jiGQiQRTVxtLlqiS0E:jRUy6tK12GfSv6hAdELpB0bVQVxtLlL
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
1dd94a6a09ece96754e43af3611cdf69c5d0c73079b9c7a5974f85136d81e04d.exe windows x86
6c271fca1ef4ab671ffd4d7ad84ae84e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasHangUpA
winmm
mixerGetLineInfoA
ws2_32
htons
kernel32
WriteFile
GetModuleHandleA
GetProcAddress
VirtualProtect
user32
GetPropA
MessageBoxA
gdi32
ExtSelectClipRgn
msimg32
GradientFill
winspool.drv
ClosePrinter
advapi32
RegQueryValueExA
shell32
SHGetSpecialFolderPathA
ole32
CreateILockBytesOnHGlobal
oleaut32
SafeArrayUnaccessData
comctl32
ImageList_GetIcon
oledlg
ord8
wininet
InternetOpenA
comdlg32
GetSaveFileNameA
Sections
.text Size: - Virtual size: 807KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 423KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 364KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 181KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 736KB - Virtual size: 735KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ