Behavioral task
behavioral1
Sample
9bf26de805d02e11397b69f7de21aa49ec9b475cd9f9f65f8743595cec774e85.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9bf26de805d02e11397b69f7de21aa49ec9b475cd9f9f65f8743595cec774e85.exe
Resource
win10v2004-20220812-en
General
-
Target
9bf26de805d02e11397b69f7de21aa49ec9b475cd9f9f65f8743595cec774e85
-
Size
1011KB
-
MD5
d34d131d935ea4cdc80485406728edb3
-
SHA1
b6946e08649c8bd5f0ade858919c8b6f6adae6b4
-
SHA256
9bf26de805d02e11397b69f7de21aa49ec9b475cd9f9f65f8743595cec774e85
-
SHA512
ba4a783e210e98e89eeeb13f748b442849462fce540889aa4212269fc3d83861e36616da1dcf17ed7c15e65cc079d95077b3ff4fd070ddd08741bb88b442257a
-
SSDEEP
24576:FNf/9IUVIuWyHbGFr6XjuLSqIUwaJfdoaKASlrj3k7qaKDP+4xCh:FNNIUVIxAbGYZq5wwnwc7OG44h
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
9bf26de805d02e11397b69f7de21aa49ec9b475cd9f9f65f8743595cec774e85.exe windows x86
41afbc741048f8bc47fee93038986864
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
FreeSid
kernel32
LocalFree
GetModuleHandleA
GetProcAddress
VirtualProtect
gdi32
GetDeviceCaps
user32
ExitWindowsEx
MessageBoxA
comctl32
ord17
version
GetFileVersionInfoA
Sections
.text Size: - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 13KB - Virtual size: 864KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 996KB - Virtual size: 996KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 112B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ