Behavioral task
behavioral1
Sample
c260b39a8e4d1247a47db42f21ab71195122ab902d1e9ae10d9c7c335d35fb50.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c260b39a8e4d1247a47db42f21ab71195122ab902d1e9ae10d9c7c335d35fb50.exe
Resource
win10v2004-20221111-en
General
-
Target
c260b39a8e4d1247a47db42f21ab71195122ab902d1e9ae10d9c7c335d35fb50
-
Size
2.6MB
-
MD5
c0a85a457ff9aa911073b1ebd85d12d3
-
SHA1
790161ad60b7bd88b3d708bed0b583123876ccfd
-
SHA256
c260b39a8e4d1247a47db42f21ab71195122ab902d1e9ae10d9c7c335d35fb50
-
SHA512
ffb362f7747691fc6a1692889c6655441de5b0faa6af0934a5db1397dbc9043c1908d50a66d1090fce7d2c7edbc753f729ecc92f2a70b971ca171767928ef9e0
-
SSDEEP
49152:wOjYFTgg9RxFIEiVbqk14iPSOw46acv4B3a4T8y5+p7k:wV99PiVbtWuv6acwB3NT86
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
c260b39a8e4d1247a47db42f21ab71195122ab902d1e9ae10d9c7c335d35fb50.exe windows x86
33ef3c818e0c9541d68e2068b4794d1b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutUnprepareHeader
ws2_32
WSACleanup
rasapi32
RasHangUpA
kernel32
GetSystemDirectoryA
GetModuleHandleA
GetProcAddress
VirtualProtect
user32
CharNextA
MessageBoxA
gdi32
EndPage
msimg32
GradientFill
winspool.drv
ClosePrinter
comdlg32
GetFileTitleA
advapi32
RegCreateKeyExA
shell32
SHGetSpecialFolderPathA
ole32
OleIsCurrentClipboard
oleaut32
SafeArrayCreate
comctl32
ImageList_Destroy
oledlg
ord8
wldap32
ord29
wininet
InternetOpenA
Sections
.text Size: - Virtual size: 806KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 803KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 363KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 100KB - Virtual size: 118KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 72B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ