Behavioral task
behavioral1
Sample
427496cf5d29c6a751ba6281851502e52d2f65508d68c3ab808fa8063aaad6dd.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
427496cf5d29c6a751ba6281851502e52d2f65508d68c3ab808fa8063aaad6dd.dll
Resource
win10v2004-20221111-en
General
-
Target
427496cf5d29c6a751ba6281851502e52d2f65508d68c3ab808fa8063aaad6dd
-
Size
392KB
-
MD5
a8ce639e95dceb2a83782f63749319aa
-
SHA1
4ba294a957785477e128c0583116c5ccdceeed31
-
SHA256
427496cf5d29c6a751ba6281851502e52d2f65508d68c3ab808fa8063aaad6dd
-
SHA512
c6d5fd82a748bd8f69980758ee28c59f366bf807173225ca9e23770e3cc5267393525771e916e0c57511f383a8fc14141e555a2c13238933536272b7edcdc820
-
SSDEEP
12288:10Zm0RtdgJEB3bK0RtAOuBEwuMKmNywq7UFo1x:1H0SJEB
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
427496cf5d29c6a751ba6281851502e52d2f65508d68c3ab808fa8063aaad6dd.dll windows x86
289395219f707d52258909320cb3bfe5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
timeKillEvent
timeSetEvent
PlaySoundA
kernel32
RtlUnwind
GetCommandLineA
HeapAlloc
HeapFree
RaiseException
ExitProcess
TerminateProcess
HeapSize
HeapReAlloc
GetACP
GetTimeZoneInformation
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
LCMapStringA
LCMapStringW
IsBadWritePtr
GetStringTypeA
GetStringTypeW
SetUnhandledExceptionFilter
SetStdHandle
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetFileTime
GetFileSize
GetFileAttributesA
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
CreateFileA
GetCurrentProcess
DuplicateHandle
FileTimeToLocalFileTime
FileTimeToSystemTime
GetOEMCP
GetCPInfo
GetProcessVersion
GetThreadLocale
GetLastError
SetLastError
GlobalFlags
MulDiv
lstrcpynA
SetErrorMode
TlsGetValue
LocalReAlloc
TlsSetValue
EnterCriticalSection
GlobalReAlloc
LeaveCriticalSection
TlsFree
GlobalHandle
DeleteCriticalSection
TlsAlloc
InitializeCriticalSection
LocalAlloc
GetCurrentThread
lstrcmpA
LoadLibraryA
FreeLibrary
GetVersion
lstrcatA
GetCurrentThreadId
GlobalGetAtomNameA
lstrcmpiA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcpyA
FormatMessageA
LocalFree
GlobalAlloc
InterlockedDecrement
InterlockedIncrement
lstrlenA
GlobalLock
GlobalUnlock
GlobalFree
LockResource
FindResourceA
LoadResource
WritePrivateProfileStringA
GetPrivateProfileIntA
GetPrivateProfileStringA
GetPrivateProfileSectionNamesA
OutputDebugStringA
Beep
GetModuleFileNameA
OpenProcess
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
IsBadCodePtr
IsBadReadPtr
ReadProcessMemory
GetTickCount
VirtualAlloc
CreateThread
CloseHandle
FreeLibraryAndExitThread
GetModuleHandleA
Sleep
FreeEnvironmentStringsW
user32
PostThreadMessageA
CharUpperA
RegisterClipboardFormatA
DestroyMenu
GetSysColorBrush
LoadCursorA
MessageBeep
GetNextDlgGroupItem
SetRect
CopyAcceleratorTableA
CharNextA
LoadStringA
GrayStringA
DrawTextA
TabbedTextOutA
GetWindowDC
GetDesktopWindow
ClientToScreen
PtInRect
GetClassNameA
UnregisterClassA
GetMessageA
ValidateRect
GetCursorPos
SetCursor
PostQuitMessage
wvsprintfA
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
LoadIconA
PostMessageA
UpdateWindow
MapWindowPoints
GetSysColor
GetFocus
AdjustWindowRectEx
IsWindowVisible
GetTopWindow
MessageBoxA
IsChild
GetCapture
WinHelpA
GetClassInfoA
RegisterClassA
GetMenu
GetMenuItemCount
GetSubMenu
GetMenuItemID
GetKeyState
CreateWindowExA
GetClassLongA
SetPropA
GetPropA
CallWindowProcA
RemovePropA
DefWindowProcA
GetMessageTime
GetMessagePos
GetLastActivePopup
GetForegroundWindow
SetForegroundWindow
RegisterWindowMessageA
OffsetRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
MapDialogRect
GetWindow
SetWindowContextHelpId
CopyRect
GetDC
ReleaseDC
GetNextDlgTabItem
EndDialog
GetActiveWindow
SetActiveWindow
IsWindow
GetSystemMetrics
CreateDialogIndirectParamA
DestroyWindow
GetParent
SetFocus
IsWindowEnabled
ShowWindow
MoveWindow
SetWindowLongA
GetDlgCtrlID
GetWindowTextLengthA
SetWindowTextA
IsDialogMessageA
SendDlgItemMessageA
SetParent
GetClientRect
GetDlgItem
SendMessageA
EnableWindow
GetWindowLongA
FindWindowA
GetWindowTextA
UnhookWindowsHookEx
GetWindowThreadProcessId
SetWindowsHookExA
CallNextHookEx
SetWindowPos
PeekMessageA
TranslateMessage
DispatchMessageA
wsprintfA
gdi32
ExtTextOutA
Escape
GetMapMode
DPtoLP
GetTextColor
GetBkColor
LPtoDP
TextOutA
ScaleWindowExtEx
RectVisible
PtVisible
GetWindowExtEx
GetViewportExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
CreateSolidBrush
SetMapMode
RestoreDC
SaveDC
DeleteDC
GetStockObject
GetDeviceCaps
SelectObject
DeleteObject
CreateBitmap
GetObjectA
SetBkColor
SetTextColor
GetClipBox
comdlg32
GetFileTitleA
winspool.drv
DocumentPropertiesA
ClosePrinter
OpenPrinterA
advapi32
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegCloseKey
shell32
ShellExecuteA
comctl32
ImageList_Destroy
ord17
oledlg
ord8
ole32
OleUninitialize
OleInitialize
CoTaskMemAlloc
CoFreeUnusedLibraries
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CLSIDFromString
CLSIDFromProgID
CoInitialize
CoRegisterMessageFilter
OleIsCurrentClipboard
OleFlushClipboard
CreateILockBytesOnHGlobal
CoRevokeClassObject
CoTaskMemFree
olepro32
ord253
oleaut32
SysStringLen
VariantChangeType
SysFreeString
SysAllocStringLen
VariantClear
VariantTimeToSystemTime
SysAllocStringByteLen
SysAllocString
VariantCopy
shlwapi
StrToIntA
Sections
.text Size: 224KB - Virtual size: 221KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 52KB - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 36KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 36KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 4KB - Virtual size: 256B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ