Behavioral task
behavioral1
Sample
b39670fc851ede61d89569d4b4a444046c6968534024fdaf0259cc83b90e33ff.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b39670fc851ede61d89569d4b4a444046c6968534024fdaf0259cc83b90e33ff.exe
Resource
win10v2004-20220901-en
General
-
Target
b39670fc851ede61d89569d4b4a444046c6968534024fdaf0259cc83b90e33ff
-
Size
7KB
-
MD5
b1a405ca9c11fcded181c8baf1e5de1e
-
SHA1
0f2a22a072357ee7469ba230124a2806c840034b
-
SHA256
b39670fc851ede61d89569d4b4a444046c6968534024fdaf0259cc83b90e33ff
-
SHA512
1d0331180a7dfd7b90d92e3242c946b7652a6b1127e1109b98c1107245f0b6775e42fab61e38262fb1f6f76e3c8a6c30f1484b99f0ca0a3e9964a3a4877913b1
-
SSDEEP
96:/Vp89tmGmwo2+XtN224CrMZeQRswi0y1aLpIC3RkME24fRQXwZCAgRbJ+3nnnxtH:T8GGlCrMbiaN3WM6qg0AgRb2nxt
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
b39670fc851ede61d89569d4b4a444046c6968534024fdaf0259cc83b90e33ff.exe windows x86
711afab1cc392c0babc5a18cf574a3a0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
KeDetachProcess
wcslen
KeAttachProcess
ZwTerminateProcess
IofCompleteRequest
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
IoGetCurrentProcess
IoCreateSymbolicLink
IoCreateDevice
_except_handler3
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 204B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 36B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 384B - Virtual size: 346B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 256B - Virtual size: 150B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 640B - Virtual size: 628B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ