Behavioral task
behavioral1
Sample
bfb50122678cdb7cbf331d5703b3ffa1e90f16725bb32e4a2f93c61e62d8334d.exe
Resource
win7-20220901-en
General
-
Target
bfb50122678cdb7cbf331d5703b3ffa1e90f16725bb32e4a2f93c61e62d8334d
-
Size
383KB
-
MD5
6b4bf7d0be754feb786ca813b91223b4
-
SHA1
61723f411e44b5e1e7e21e61607481f6869f3ee2
-
SHA256
bfb50122678cdb7cbf331d5703b3ffa1e90f16725bb32e4a2f93c61e62d8334d
-
SHA512
59d8a61163a3e304865ec6410fd9ec5d60f625afe717df8d4b2e6005be101215171210b014ad8eb3af9d63caf1fe6a3e87a8b0cb2683da7c4ca21dbf9ba1703a
-
SSDEEP
6144:lcUw3Ntxmo7euMVKOfAUwM9I3EWo+SFyJ/q1aYJ0y+fORVanj5IoHTT:y5qud0Ae9IZP+4/qAYey9W5IoH3
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
bfb50122678cdb7cbf331d5703b3ffa1e90f16725bb32e4a2f93c61e62d8334d.exe windows x86
11cbdfb47fdc9152560598c88ea044f0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GlobalLock
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
LoadCursorA
MessageBoxA
advapi32
RegEnumKeyExA
ole32
CoTaskMemRealloc
oleaut32
SysStringLen
gdi32
GetStockObject
ntdll
RtlFreeHeap
Sections
.text Size: - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 168KB - Virtual size: 195KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 65KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 214KB - Virtual size: 213KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 128B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ