Behavioral task
behavioral1
Sample
5865e7f713e3fca957d48fc84c1bcb41b2c37c22bdb621026e839c7ea3b9eb98.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
5865e7f713e3fca957d48fc84c1bcb41b2c37c22bdb621026e839c7ea3b9eb98.exe
Resource
win10v2004-20221111-en
General
-
Target
5865e7f713e3fca957d48fc84c1bcb41b2c37c22bdb621026e839c7ea3b9eb98
-
Size
820KB
-
MD5
ec07d1ced187400d6feb61431c9c9317
-
SHA1
d5feaf62326eb9ff5090b08bc9a41db7802d3028
-
SHA256
5865e7f713e3fca957d48fc84c1bcb41b2c37c22bdb621026e839c7ea3b9eb98
-
SHA512
959c0238128613527d4498d6e682405774ef136291111f0508546ca657523749425d0ba5b43c8f2fd67ecc5cab71350de483e07159924dc8f1dfd4be7177f202
-
SSDEEP
12288:tBoImQSN/03aM11Y1/EI38nuISsb2UsHTUa0i+JbP4sNpYhwSwYF55TAUIfJqfBc:ASC03af1L8bR7yhwSnHTHIA5c
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
5865e7f713e3fca957d48fc84c1bcb41b2c37c22bdb621026e839c7ea3b9eb98.exe windows x86
cd15247c4b9a040a561cb0f0f5b7c6fe
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamOut
ws2_32
bind
kernel32
GetVersion
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetSystemMenu
MessageBoxA
gdi32
GetMapMode
winspool.drv
ClosePrinter
advapi32
RegOpenKeyExA
shell32
Shell_NotifyIconA
ole32
StgCreateDocfileOnILockBytes
oleaut32
SafeArrayGetUBound
comctl32
ImageList_GetIcon
oledlg
ord8
comdlg32
GetSaveFileNameA
Sections
.text Size: - Virtual size: 675KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 259KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 243KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 196KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 800KB - Virtual size: 796KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 204B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ