Behavioral task
behavioral1
Sample
872737c8e70d4e47703836073aa4f4a0cc68251aaaa92b5b77745e0ea2f39a45.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
872737c8e70d4e47703836073aa4f4a0cc68251aaaa92b5b77745e0ea2f39a45.exe
Resource
win10v2004-20221111-en
General
-
Target
872737c8e70d4e47703836073aa4f4a0cc68251aaaa92b5b77745e0ea2f39a45
-
Size
908KB
-
MD5
e0bd510086613da690b1049e3342ccf6
-
SHA1
58f590412b4547b47629593e42cf8b1b848f395f
-
SHA256
872737c8e70d4e47703836073aa4f4a0cc68251aaaa92b5b77745e0ea2f39a45
-
SHA512
5a0e53ddc88bdcdf8163a12d0ca1ff1782fad411f795ec26c3571aeef0427454dad9f9cd86fb08d7e4ac657eba19d65e8f521d48b9f26e6e47d0d215c3967781
-
SSDEEP
12288:K1siQcb5IKbMyj8+FKSn52e7NaWGqjt+EBuBzVfcwfFoL+Qn4nNxS+UPVX7te:jcb5mS945KMEBkjq+Qn4Nk1te
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
872737c8e70d4e47703836073aa4f4a0cc68251aaaa92b5b77745e0ea2f39a45.exe windows x86
4bd98c52817e06b25ee82b701ef72b15
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamOut
ws2_32
WSAAsyncSelect
kernel32
MultiByteToWideChar
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
IsIconic
MessageBoxA
gdi32
GetTextMetricsA
winspool.drv
OpenPrinterA
advapi32
RegCloseKey
shell32
ShellExecuteA
ole32
CLSIDFromString
oleaut32
LoadTypeLi
comctl32
ord17
comdlg32
ChooseColorA
Sections
.text Size: - Virtual size: 571KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 419KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 183KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 147KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 880KB - Virtual size: 876KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE