Behavioral task
behavioral1
Sample
65490f091fc0f2dae9c4123fa853894927b8bf6b090fc8be8b0a441fff73651f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
65490f091fc0f2dae9c4123fa853894927b8bf6b090fc8be8b0a441fff73651f.exe
Resource
win10v2004-20220812-en
General
-
Target
65490f091fc0f2dae9c4123fa853894927b8bf6b090fc8be8b0a441fff73651f
-
Size
819KB
-
MD5
0e913d3a4bd0726357bb608f4aa14733
-
SHA1
f931fdcf89cfddfa6c63f04428a1a2070ebfa31e
-
SHA256
65490f091fc0f2dae9c4123fa853894927b8bf6b090fc8be8b0a441fff73651f
-
SHA512
8c9247d57d46aa45ae6e063d66128b5a05ebcb760d2217e6d0bf7900b4f03977eb9894ddc3be438d09f525127e89a24c69d410fbaf429c0bb747b2b2a2b382a2
-
SSDEEP
12288:kbgGS5qs5cL7PAtaVQZ5HcmMcpnOtRn30isBlmVVlV0DJ5410S1k6S00NKKPrq9z:kvs2PAT5HhMinepvWAAdI9C50KKiyz
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
65490f091fc0f2dae9c4123fa853894927b8bf6b090fc8be8b0a441fff73651f.exe windows x86
796dd60c6997bbf16ab21508db40c9a0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
PsLookupProcessByProcessId
IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
ExAllocatePool
ExFreePool
NtQuerySystemInformation
hal
KfRaiseIrql
HalMakeBeep
Sections
.text Size: - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 428B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 696KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 817KB - Virtual size: 817KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 368B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ