Behavioral task
behavioral1
Sample
b6c8fa1cbe966c6e7936c1599864d858bd06372223ce874f2ecbae92dcbf8bae.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
b6c8fa1cbe966c6e7936c1599864d858bd06372223ce874f2ecbae92dcbf8bae.exe
Resource
win10v2004-20221111-en
General
-
Target
b6c8fa1cbe966c6e7936c1599864d858bd06372223ce874f2ecbae92dcbf8bae
-
Size
351KB
-
MD5
4758dd1bb46676c8599338fbf0dea8b7
-
SHA1
426d13d0bc6734494bbb6ae8abcabce2fafd68a2
-
SHA256
b6c8fa1cbe966c6e7936c1599864d858bd06372223ce874f2ecbae92dcbf8bae
-
SHA512
5514f3545d606ef8cc62bb8f104a6d641e02646bd5a6107ef1ff8ceb42e1c947266bf45168cfbca587d7623204308e7d53cde016bb6b4b5ba88d180f9f988b5e
-
SSDEEP
6144:BhOhI966ANdgUd88MHqBwmBbK58/Fq4PdpnZ2QMSt0ajqjda1:BQq6z+82qBbY14FpZ2QIajqj41
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
b6c8fa1cbe966c6e7936c1599864d858bd06372223ce874f2ecbae92dcbf8bae.exe windows x86
dc87eb7753f30b9827169a8cdad5d541
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
GetModuleHandleA
LoadLibraryA
RaiseException
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
msvbvm60
__vbaVarSub
oleaut32
VariantChangeTypeEx
user32
MessageBoxA
Sections
Size: 16KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 314KB - Virtual size: 316KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ