Behavioral task
behavioral1
Sample
8431b8decf8c823cde7ed6d91b387093547d33385f9476c320151fc2ddb766fe.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8431b8decf8c823cde7ed6d91b387093547d33385f9476c320151fc2ddb766fe.exe
Resource
win10v2004-20221111-en
General
-
Target
8431b8decf8c823cde7ed6d91b387093547d33385f9476c320151fc2ddb766fe
-
Size
776KB
-
MD5
0b0d58970990e6af7f53f5b9ffbd3b4f
-
SHA1
425cf0ea67546175706e136fe96d2652767e3c48
-
SHA256
8431b8decf8c823cde7ed6d91b387093547d33385f9476c320151fc2ddb766fe
-
SHA512
7d1ddcaa9e244c8001ae508a0ae648a5bdddf7d03b2f11e6787320ff54ad19faf1a2c6a68d46f9e7273be0e15e033136511102634308c4d94e7693db64dde686
-
SSDEEP
24576:fKjX2UgfSV9U2J+R6HCUu16Ita+Tg4SeWsVac+aBDRoc5:f4FgfSb+R6HCP1Aq7SeXyDc5
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
8431b8decf8c823cde7ed6d91b387093547d33385f9476c320151fc2ddb766fe.exe windows x86
981635ec156ba6c1b503eaf6267f6068
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ExAllocatePoolWithTag
IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
ExAllocatePool
ExFreePool
NtQuerySystemInformation
hal
KfLowerIrql
HalMakeBeep
Sections
.text Size: - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 372B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 894B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 657KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 767KB - Virtual size: 767KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 360B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ