Behavioral task
behavioral1
Sample
daf420385f8ee21a1769f7d5960988a27960530370ec93bd7e345f5a2a69d543.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
daf420385f8ee21a1769f7d5960988a27960530370ec93bd7e345f5a2a69d543.exe
Resource
win10v2004-20220901-en
General
-
Target
daf420385f8ee21a1769f7d5960988a27960530370ec93bd7e345f5a2a69d543
-
Size
724KB
-
MD5
a76ce2b14d0735b859a3d9ea010e2834
-
SHA1
f2804d93f378e42e0d4598dc8463218d383a30aa
-
SHA256
daf420385f8ee21a1769f7d5960988a27960530370ec93bd7e345f5a2a69d543
-
SHA512
5a73c6979c7fcce3a51cefda5536fba213e4db4429807beb5a012803bf348e97b8c1c49878978562b18b8c0d5b02eac2486ab4d017349282cba52529954f793e
-
SSDEEP
12288:HWWuVi8OohmMh16zNfJodQ5YshEFYltNyUQ1dwBmsg6PVxcvw2durMxCE097GdYH:2WuVimUM16z1Jh5YxqCdq1VSvwWuIxCv
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
daf420385f8ee21a1769f7d5960988a27960530370ec93bd7e345f5a2a69d543.exe windows x86
bde3155d6accfc37836a59098cec8eee
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcmpiA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
SetClipboardData
MessageBoxA
gdi32
SetStretchBltMode
winmm
midiStreamRestart
winspool.drv
ClosePrinter
advapi32
RegCreateKeyExA
shell32
ShellExecuteA
ole32
CreateILockBytesOnHGlobal
oleaut32
SafeArrayCreate
comctl32
ImageList_Destroy
oledlg
ord8
ws2_32
recv
comdlg32
GetOpenFileNameA
Sections
.text Size: - Virtual size: 677KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 250KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 126KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 171KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 688KB - Virtual size: 684KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 120B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ