Behavioral task
behavioral1
Sample
f6419c031704a5f863a689081ad99c3fd07dcaa907e5474054a32b4c4ca1b8ed.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
f6419c031704a5f863a689081ad99c3fd07dcaa907e5474054a32b4c4ca1b8ed.exe
Resource
win10v2004-20220812-en
General
-
Target
f6419c031704a5f863a689081ad99c3fd07dcaa907e5474054a32b4c4ca1b8ed
-
Size
396KB
-
MD5
af95333a4f34890aa62d1f247bd076e0
-
SHA1
ea7a4bc6ba6a15ab2326db225eac0621aa18e1db
-
SHA256
f6419c031704a5f863a689081ad99c3fd07dcaa907e5474054a32b4c4ca1b8ed
-
SHA512
0eb2bfb381b41e8e90b75428105b9527fd9d2c396c727106d065f6222ba04d6f68646e84a14d8047a063c57f5fd3d82470cabd8983c54dccab3d17898693bf8f
-
SSDEEP
6144:aExKucH+fOkEXRTrC6kpitmdD019YRwwhaXx2i7SFf:qucH+fOkEXRTrC6/mdD0oRDoHI
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
f6419c031704a5f863a689081ad99c3fd07dcaa907e5474054a32b4c4ca1b8ed.exe windows x86
76d9d0658def6ac1c4f060dc6f2fd8a4
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
LoadLibraryA
ResumeThread
SetThreadContext
WriteProcessMemory
lstrcmpiA
GetModuleFileNameA
ReadProcessMemory
GetThreadContext
CreateProcessA
ExitProcess
CloseHandle
GetCurrentProcess
WideCharToMultiByte
MultiByteToWideChar
OutputDebugStringA
DeleteFileA
MoveFileA
FreeResource
lstrlenA
WriteFile
SetFileTime
LocalFileTimeToFileTime
FindFirstFileA
lstrcatA
CreateFileA
LoadResource
FindResourceA
GetTickCount
GetTempPathA
lstrcpyA
SetLastError
GetLastError
ReadFile
SetFilePointer
GetPrivateProfileStringA
WritePrivateProfileStringA
CreateDirectoryA
GetFileAttributesA
SetUnhandledExceptionFilter
Sleep
ReleaseMutex
CreateMutexA
GetCommandLineA
GetCurrentThreadId
RaiseException
InterlockedExchange
LocalAlloc
FreeLibrary
GetStartupInfoA
GetModuleHandleA
VirtualProtect
GetModuleFileNameA
ExitProcess
msvcrt
_except_handler3
strchr
??3@YAXPAX@Z
??2@YAPAXI@Z
rand
strstr
??1type_info@@UAE@XZ
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
memset
memcpy
strlen
malloc
realloc
_CxxThrowException
__CxxFrameHandler
_strcmpi
ntdll
ZwUnmapViewOfSection
user32
MessageBoxA
Sections
.text Size: - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 286KB - Virtual size: 424KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
yuxuan Size: - Virtual size: 188B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 109KB - Virtual size: 108KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 52B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ