Behavioral task
behavioral1
Sample
ae387a1b9f0b7bb13fecb13ddab8361d51700d54ccffb8a8b80214b00415445b.exe
Resource
win7-20220812-en
General
-
Target
ae387a1b9f0b7bb13fecb13ddab8361d51700d54ccffb8a8b80214b00415445b
-
Size
121KB
-
MD5
1aa48fd8ced520290f7a5206f0812880
-
SHA1
27c0e8e57a14c08353652d601a2d46ddfd80ff55
-
SHA256
ae387a1b9f0b7bb13fecb13ddab8361d51700d54ccffb8a8b80214b00415445b
-
SHA512
3c6be6decca881dffb5a085c1826d47ff8badf9da960372d3b53f567ce60eb0d4163e6e0583d581d7573a6f9dcab9f1e0755287bafd34c27c70d93da89982e5c
-
SSDEEP
3072:/bXHC0G9e5Ueo6kqFU6IvxwyyyhBIpKXvqi2:/bXC0nX0Vvy4IpQqB
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
ae387a1b9f0b7bb13fecb13ddab8361d51700d54ccffb8a8b80214b00415445b.exe windows x86
9e0cf9189ed428367c6458f1e0da0f91
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateEventA
GetProcAddress
LoadLibraryA
FindResourceA
WaitForSingleObject
GetStringTypeW
GetStringTypeA
GetModuleFileNameA
GetTickCount
LoadResource
LockResource
SizeofResource
DeleteFileA
CreateFileA
WriteFile
Sleep
FreeResource
GetWindowsDirectoryA
CloseHandle
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
GetLastError
SetFilePointer
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
SetStdHandle
MultiByteToWideChar
LCMapStringA
LCMapStringW
FlushFileBuffers
VirtualProtect
GetModuleFileNameA
ExitProcess
advapi32
OpenServiceA
ChangeServiceConfigA
ControlService
StartServiceA
RegCreateKeyExA
RegOpenKeyA
RegSetValueExA
RegCloseKey
OpenSCManagerA
gdi32
GetStockObject
user32
RegisterClassA
MessageBoxA
Sections
.text Size: - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 152KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 118KB - Virtual size: 117KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 76B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ