Behavioral task
behavioral1
Sample
e2cb3d35fbf16ddc508365a9da86d9f7d7e808eaec78b73f64edb4355f9fb3cd.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
e2cb3d35fbf16ddc508365a9da86d9f7d7e808eaec78b73f64edb4355f9fb3cd.exe
Resource
win10v2004-20220812-en
General
-
Target
e2cb3d35fbf16ddc508365a9da86d9f7d7e808eaec78b73f64edb4355f9fb3cd
-
Size
924KB
-
MD5
ae35ee5536269558bd1e05afa8c4fae2
-
SHA1
bd8bcd299a36d21752f215e2af0a50815c1c5d4c
-
SHA256
e2cb3d35fbf16ddc508365a9da86d9f7d7e808eaec78b73f64edb4355f9fb3cd
-
SHA512
00ce9768045084a7ceb0fb48e75285714e30a2763463cf2f5df4e09a8e32baed30b4e6b5e56b747addd04c382f7bd91df5247337f7d8462ab26772289e20c8ee
-
SSDEEP
24576:DHxaMgPCqBwZu3B6Wrg9VxADMAMtxdmE273PspK27De8wz3hB56:tw3qkUIOVxAQN0POK2Ub56
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
e2cb3d35fbf16ddc508365a9da86d9f7d7e808eaec78b73f64edb4355f9fb3cd.exe windows x86
615f5efc8843b10213bae2a2e8ea4f70
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutPause
ws2_32
ioctlsocket
kernel32
GetTimeZoneInformation
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
ScrollWindowEx
gdi32
GetViewportOrgEx
winspool.drv
OpenPrinterA
advapi32
RegCloseKey
shell32
ShellExecuteA
ole32
CoTaskMemFree
oleaut32
SafeArrayGetUBound
comctl32
ord17
oledlg
ord8
comdlg32
ChooseColorA
Sections
.text Size: - Virtual size: 480KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 94KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 199KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 537KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 908KB - Virtual size: 905KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE