Behavioral task
behavioral1
Sample
c0fff843a7b9338959cde98b288e7ba622b3b2252d5425bdb620c4577a141b59.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c0fff843a7b9338959cde98b288e7ba622b3b2252d5425bdb620c4577a141b59.exe
Resource
win10v2004-20221111-en
General
-
Target
c0fff843a7b9338959cde98b288e7ba622b3b2252d5425bdb620c4577a141b59
-
Size
760KB
-
MD5
8cef4ee6878dc24dbf84535bbaa57b3c
-
SHA1
c451ca5f2e50427e1a8c27769b1cc9b2756c204e
-
SHA256
c0fff843a7b9338959cde98b288e7ba622b3b2252d5425bdb620c4577a141b59
-
SHA512
271c09b7cf9a4f252c0320d86be437115a909948e8915a41b272ac13e75a5de2b79258dc8259ab9789ed152f4674339a5b65ae90ece0086ac5ae2b00bac9b05d
-
SSDEEP
12288:sk89ckFon0GozDjSo+5tp7o5XBR3gFCIzhYJT/2TZu0MY6bVAsyEMD43XUhYUys6:OGkCnTEvSo4tps5XP3g3zhEjgZu53yD0
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
c0fff843a7b9338959cde98b288e7ba622b3b2252d5425bdb620c4577a141b59.exe windows x86
f645361442720d3ece3872e950d0a607
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwSetInformationFile
IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
ExAllocatePool
ExFreePool
NtQuerySystemInformation
hal
KfAcquireSpinLock
HalMakeBeep
Sections
.text Size: - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 404B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 660KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 759KB - Virtual size: 758KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ