Behavioral task
behavioral1
Sample
34e8cf2b611e37f8141d4b5759be959cd66194a5725f595436803743daaa08fe.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
34e8cf2b611e37f8141d4b5759be959cd66194a5725f595436803743daaa08fe.exe
Resource
win10v2004-20221111-en
General
-
Target
34e8cf2b611e37f8141d4b5759be959cd66194a5725f595436803743daaa08fe
-
Size
714KB
-
MD5
132094af04e197fa39e5a4183c81ff32
-
SHA1
955caebfd0619321142bb47ab1008d31decfc2fb
-
SHA256
34e8cf2b611e37f8141d4b5759be959cd66194a5725f595436803743daaa08fe
-
SHA512
136170da3da8600d12d8c3a26ad5670573418e74e9abce80432c392b9669e9974a5d737b70a2913c9493a87b66a22f6cb53bca886ebfe26b59212a2a0bd6d678
-
SSDEEP
12288:tXsLCUKdsiYg0l035CqsHu4wIS5IgANwI7n/QSfYjUsn0JqGV76cM+Vj1a3:t8LCUKi20lysHu4/gjI7nI9cIOKGj18
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
34e8cf2b611e37f8141d4b5759be959cd66194a5725f595436803743daaa08fe.exe windows x86
bb70ee214b0bfb1727854349981ddf84
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
RtlAssert
IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
ExAllocatePool
ExFreePool
NtQuerySystemInformation
hal
KfRaiseIrql
HalMakeBeep
Sections
.text Size: - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 372B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 894B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 604KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 712KB - Virtual size: 712KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 296B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ