Behavioral task
behavioral1
Sample
60b4b829baa82ef80f2f7a5f307480b0d59fb5a1f1d436bb5534143936803308.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
60b4b829baa82ef80f2f7a5f307480b0d59fb5a1f1d436bb5534143936803308.dll
Resource
win10v2004-20221111-en
General
-
Target
60b4b829baa82ef80f2f7a5f307480b0d59fb5a1f1d436bb5534143936803308
-
Size
904KB
-
MD5
253243efa1f7f981be13536bf0b37ee8
-
SHA1
71456fe201419f4d6003d8ca175ce70a04ae0190
-
SHA256
60b4b829baa82ef80f2f7a5f307480b0d59fb5a1f1d436bb5534143936803308
-
SHA512
a58ae4053d6db9c449d05c58217a2314ef95a6d2eb93e8c0b254b34e18a626f61bfd4400e3d8d99bafe786b693cc7ac06f77fc0800f07f28ea0fced085ec2545
-
SSDEEP
24576:henowC/krhizl52AJdYjwF1OD5spbKzzg:heAhUA/Jpb
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
60b4b829baa82ef80f2f7a5f307480b0d59fb5a1f1d436bb5534143936803308.dll windows x86
332244912e7295b37871eef2b7ce7275
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameA
VirtualProtectEx
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualProtect
LoadLibraryA
OpenEventA
SetUnhandledExceptionFilter
GetTickCount
ReadProcessMemory
lstrcatA
TerminateProcess
GetLocalTime
GetSystemTime
GetModuleFileNameW
CreateFileW
GetCurrentProcessId
lstrcpyA
MapViewOfFile
OpenFileMappingA
GetProcAddress
GetModuleHandleA
Sleep
CreateThread
MultiByteToWideChar
WideCharToMultiByte
OutputDebugStringA
GetTempPathA
WriteProcessMemory
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
GetTimeZoneInformation
GetUserDefaultLCID
EnumSystemLocalesA
GetLocaleInfoA
IsValidCodePage
IsValidLocale
SetEndOfFile
GetOEMCP
InterlockedExchange
DeleteCriticalSection
RtlUnwind
HeapFree
HeapAlloc
GetCommandLineA
GetVersion
RaiseException
ExitProcess
GetCurrentProcess
HeapReAlloc
HeapSize
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
CloseHandle
ReadFile
SetFilePointer
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
InterlockedDecrement
InterlockedIncrement
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
SetStdHandle
FlushFileBuffers
CreateFileA
LCMapStringA
LCMapStringW
GetCPInfo
GetACP
GetLocalTime
SystemTimeToFileTime
CompareFileTime
GetTickCount
TerminateProcess
GetCurrentProcess
CreateEventW
GetModuleHandleW
VirtualFree
VirtualProtect
VirtualAlloc
GetSystemInfo
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetModuleFileNameW
DeleteCriticalSection
LoadLibraryW
CompareStringW
CreateToolhelp32Snapshot
GetCurrentProcessId
GetCurrentThreadId
Thread32First
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
SetLastError
GetModuleHandleA
FreeLibrary
GetCommandLineA
HeapAlloc
RaiseException
GetLastError
HeapFree
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WriteFile
GetStdHandle
GetModuleFileNameA
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
Sleep
ExitProcess
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetSystemTimeAsFileTime
HeapSize
HeapReAlloc
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetLocaleInfoA
RtlUnwind
InitializeCriticalSectionAndSpinCount
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
VirtualQuery
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
GetKeyState
MessageBoxW
wsprintfW
MessageBoxA
wininet
InternetCloseHandle
InternetSetOptionA
InternetOpenA
InternetOpenUrlA
InternetReadFile
shlwapi
PathFileExistsA
Sections
.text Size: 120KB - Virtual size: 116KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 16KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 684KB - Virtual size: 681KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 32KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ