Behavioral task
behavioral1
Sample
853b9e37266e979976565e4e148a10634764aff47bd354a69eb47ef4dc5f7bce.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
853b9e37266e979976565e4e148a10634764aff47bd354a69eb47ef4dc5f7bce.exe
Resource
win10v2004-20221111-en
General
-
Target
853b9e37266e979976565e4e148a10634764aff47bd354a69eb47ef4dc5f7bce
-
Size
823KB
-
MD5
fa23be7753a9665cd1d8d9ea45b41f30
-
SHA1
106d2465a4c3f2ccfa90b8c06b6ac68ede0655dd
-
SHA256
853b9e37266e979976565e4e148a10634764aff47bd354a69eb47ef4dc5f7bce
-
SHA512
54ea4a6576aac410144d918011eb847fe75b3cb6c5007a375e26b114dcdd6a3bfba6bf45ed7a585c764b713c14275960f7b6bb6922ace6b5dde3b7ed49cfcb70
-
SSDEEP
12288:MzsaUBQ5SpNH0bkpqTsYkoa2IqAI+WV0GirE5xiRu50zUbaW3pLP15S2B/1J:MzsaUBQ5SpNH0Bwt9R6h6zmawpLtJ
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
853b9e37266e979976565e4e148a10634764aff47bd354a69eb47ef4dc5f7bce.exe windows x86
40edb3ba70d9b50f9eabd2a3a68bfaf1
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ZwQuerySystemInformation
IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
ExAllocatePool
ExFreePool
NtQuerySystemInformation
hal
KeGetCurrentIrql
HalMakeBeep
Sections
.text Size: - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 699KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 822KB - Virtual size: 821KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ