Behavioral task
behavioral1
Sample
f61feb32d6f38149276e166730a37d3572b0658c2780b08f24b8318213a2258a.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
f61feb32d6f38149276e166730a37d3572b0658c2780b08f24b8318213a2258a.exe
Resource
win10v2004-20221111-en
General
-
Target
f61feb32d6f38149276e166730a37d3572b0658c2780b08f24b8318213a2258a
-
Size
884KB
-
MD5
7d5e2c9965256b2f2ba4125e3fdae5fa
-
SHA1
12e36aefb3579d4f44c59f0cd697ca0e90902ef2
-
SHA256
f61feb32d6f38149276e166730a37d3572b0658c2780b08f24b8318213a2258a
-
SHA512
405253b97163c85ccc1a3e5cda9ab0e7d6a553daa198a7abda6ff80a9cf291e7aa57d7e7b89e215845d85e764627327096cdef4a5f4a076aff3f86d99d867bc3
-
SSDEEP
24576:SYDunrxBRcuslBwPV2m5F+BJsH3+0QnAI7:S+ulBRcuQwPz54BJsH3+J
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
f61feb32d6f38149276e166730a37d3572b0658c2780b08f24b8318213a2258a.exe windows x86
1b805d5f544bf8eda3077aa4d7888ed7
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcmpiA
GetModuleHandleA
GetProcAddress
VirtualProtect
user32
SetClipboardData
MessageBoxA
gdi32
SetStretchBltMode
winmm
midiStreamRestart
winspool.drv
ClosePrinter
advapi32
RegCreateKeyExA
shell32
ShellExecuteA
ole32
CreateILockBytesOnHGlobal
oleaut32
LoadTypeLi
comctl32
ImageList_Destroy
oledlg
ord8
ws2_32
recv
comdlg32
GetOpenFileNameA
Sections
.text Size: - Virtual size: 478KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 1023KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 186KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 135KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 864KB - Virtual size: 862KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 168B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ