Behavioral task
behavioral1
Sample
608d28725405dab81307ce9b1c3ee7862e5c45dd3bd4118d8287c0f8e3624c93.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
608d28725405dab81307ce9b1c3ee7862e5c45dd3bd4118d8287c0f8e3624c93.exe
Resource
win10v2004-20221111-en
General
-
Target
608d28725405dab81307ce9b1c3ee7862e5c45dd3bd4118d8287c0f8e3624c93
-
Size
668KB
-
MD5
ffaa8e8ee368d229cfa0f32129ce0730
-
SHA1
d874126641e5aba5081b5ac5bff6f799e6bb1494
-
SHA256
608d28725405dab81307ce9b1c3ee7862e5c45dd3bd4118d8287c0f8e3624c93
-
SHA512
b19815687075922c95d6f7857c85ece830cd1b6a76f4f2ae890b6f30179db6cfd5cbb0bab5728b664f9169d4e7216fa16df356f94427d662ceec1b1f5de0f9f1
-
SSDEEP
12288:fv0o2gBUHwrMcvTAOO3uCvEf43ej6GapEuZPWsw7rKAPHX0i4BGQJt8+Na8+xOqK:fvsWXTAveCEfeGQEuZeXVHX0icTg23ua
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
608d28725405dab81307ce9b1c3ee7862e5c45dd3bd4118d8287c0f8e3624c93.exe windows x86
cadeb96548b8dd288cb5b7db0d8dec7e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
strlen
IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
ExAllocatePool
ExFreePool
NtQuerySystemInformation
hal
KeGetCurrentIrql
HalMakeBeep
Sections
.text Size: - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 372B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 894B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 566KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 666KB - Virtual size: 666KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 352B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ