Behavioral task
behavioral1
Sample
c1a8e4374a234e05454945508c8943f52a24572c0d8db199c47e2248605dae7f.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
c1a8e4374a234e05454945508c8943f52a24572c0d8db199c47e2248605dae7f.exe
Resource
win10v2004-20221111-en
General
-
Target
c1a8e4374a234e05454945508c8943f52a24572c0d8db199c47e2248605dae7f
-
Size
175KB
-
MD5
ebce79df6b942c84bce2b660c9355d10
-
SHA1
a632963cf776e4c9169b1e335f16848f48d0faf6
-
SHA256
c1a8e4374a234e05454945508c8943f52a24572c0d8db199c47e2248605dae7f
-
SHA512
4e4cb9987befaa6d5eea3be073902b42fd5f5d2c887400063aa430cb99e5e84292ee96cf6ff9d520fd0a47304a40908c628386f7cf984a5a2ceb3b4d1bd9dc43
-
SSDEEP
3072:t+BC3K5eqcFIFZzcFn1qbFR/OJe+qZ10yoJ+vo3AORPJHGIYSpL58fx:fK7cFyc12dkqf92+AzRPZGItpt8fx
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
c1a8e4374a234e05454945508c8943f52a24572c0d8db199c47e2248605dae7f.exe windows x86
3fbad927aeb9f1ec50f749eaed9685f3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
user32
MessageBoxA
MessageBoxA
advapi32
ControlService
ntdll
NtCreateFile
kernel32
TlsAlloc
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
Sections
.text Size: - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 25KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 148KB - Virtual size: 147KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 124B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ