Behavioral task
behavioral1
Sample
9cff9767874fe7703148cb792d09048baf309295b68521b72f92a9af75462dbb.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9cff9767874fe7703148cb792d09048baf309295b68521b72f92a9af75462dbb.exe
Resource
win10v2004-20220812-en
General
-
Target
9cff9767874fe7703148cb792d09048baf309295b68521b72f92a9af75462dbb
-
Size
181KB
-
MD5
ff9a40590cc79cc87b2cb7fb98f3c392
-
SHA1
55cb3a09edd71b194f47d564edae4a793b9ed55a
-
SHA256
9cff9767874fe7703148cb792d09048baf309295b68521b72f92a9af75462dbb
-
SHA512
12c61c6a4905fa4065c542c3ac2dff417d79cc1100da6ba40c49c8026c318e336727afbd73d517f5f6026e1a8a462bf8767592013554100ea007b9762bef7b80
-
SSDEEP
3072:7+BC3K5eqCB65owTzodGrHvH4EEPw4YJCNhjPKAM2fmbtXjC:1K7O65owTEdGrHP4EE6YbjE2eh
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
9cff9767874fe7703148cb792d09048baf309295b68521b72f92a9af75462dbb.exe windows x86
3fbad927aeb9f1ec50f749eaed9685f3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
user32
MessageBoxA
MessageBoxA
advapi32
ControlService
ntdll
NtCreateFile
kernel32
TlsAlloc
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
Sections
.text Size: - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 25KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 154KB - Virtual size: 154KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ