Behavioral task
behavioral1
Sample
e2c05a0ea0e1503ae1afc57710d356cd536d0dd67e6848aca734117acb101699.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
e2c05a0ea0e1503ae1afc57710d356cd536d0dd67e6848aca734117acb101699.exe
Resource
win10v2004-20220812-en
General
-
Target
e2c05a0ea0e1503ae1afc57710d356cd536d0dd67e6848aca734117acb101699
-
Size
523KB
-
MD5
7c2bc2449fd10dde97a264103c2faa8a
-
SHA1
9d97d4e22150a5010c8a31889641d328b432a6cd
-
SHA256
e2c05a0ea0e1503ae1afc57710d356cd536d0dd67e6848aca734117acb101699
-
SHA512
c081612438cc19d6710634ed236181ddcd725eabc289c021fa99943549a769cb5e9c7c649885430b6d1e7570a39a99f13382698b51fb73e9ffab8fe2512d4370
-
SSDEEP
12288:5H2tFdN5aDN2Prc8T4oNaajhj82CFfqsS9QHdtW2BsqKDFHx:5H2rhiNSI8T4KvhjbCxHGtqEFR
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
e2c05a0ea0e1503ae1afc57710d356cd536d0dd67e6848aca734117acb101699.exe windows x86
2d72038e6e4b4c560cee9d1ae866e058
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
uskin
ord1
kernel32
GetFileTime
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
SetWindowPos
gdi32
GetStockObject
comdlg32
GetFileTitleA
winspool.drv
DocumentPropertiesA
advapi32
RegCreateKeyExA
shell32
DragQueryFileA
comctl32
ord17
shlwapi
PathStripToRootA
oledlg
ord8
ole32
CoRegisterMessageFilter
oleaut32
VariantInit
wininet
InternetQueryDataAvailable
ws2_32
inet_addr
Sections
.text Size: - Virtual size: 253KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 65KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 289KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 513KB - Virtual size: 513KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 184B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ