Behavioral task
behavioral1
Sample
f5d277a83137161f0c749a67076fb568226d24026e6b0dfb0bf4b741868314d9.exe
Resource
win7-20221111-en
General
-
Target
f5d277a83137161f0c749a67076fb568226d24026e6b0dfb0bf4b741868314d9
-
Size
2.8MB
-
MD5
3863a90a25bfe16e0cd0813544a8106c
-
SHA1
02c15a22c90a8dc01949fa5bc1239b02b0d3df2e
-
SHA256
f5d277a83137161f0c749a67076fb568226d24026e6b0dfb0bf4b741868314d9
-
SHA512
022c46ac4f819a97faadbb8ae819881e42f19609b085d5a25f759ba6b52a67cc98572e27765555cb6c46942cdbf476eed0dcf5cb8ec50909a11781bb7de97d3d
-
SSDEEP
49152:6kt+/C6eHCGrMYmK4XIrBM3B41MwYqrh25KCj9VIDsXgWiawg7aGPcInuly232Ep:PtjiGrdmnXIm41Mwj05J5GJW9770Ty2B
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
f5d277a83137161f0c749a67076fb568226d24026e6b0dfb0bf4b741868314d9.exe windows x86
c74128ca50eb3d574e32341b3bf08fcf
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutUnprepareHeader
ws2_32
ioctlsocket
kernel32
GlobalUnlock
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
FindWindowExA
gdi32
GetROP2
winspool.drv
ClosePrinter
advapi32
RegSetValueExA
shell32
Shell_NotifyIconA
ole32
CLSIDFromString
oleaut32
LoadTypeLi
comctl32
ImageList_Destroy
comdlg32
GetFileTitleA
Sections
.text Size: - Virtual size: 467KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 207KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 332KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE