Behavioral task
behavioral1
Sample
ca5a39ce2bddef5588b96d9e2d0b2d6c5a29b81112df3f6c346d62dd0e0b171c.exe
Resource
win7-20221111-en
General
-
Target
ca5a39ce2bddef5588b96d9e2d0b2d6c5a29b81112df3f6c346d62dd0e0b171c
-
Size
1.7MB
-
MD5
612974331c1a8ae003d72055336a032f
-
SHA1
409b87c93daf81317b3b78e077bd2c8a65883dfa
-
SHA256
ca5a39ce2bddef5588b96d9e2d0b2d6c5a29b81112df3f6c346d62dd0e0b171c
-
SHA512
e90081e7c9b81dbcf7715ac9752d899048c604f33102e694d959b46661fb5e9444606fc7abeda1a5ef668db8b32a868dcae1da26736f13ee6d570745c47d02a4
-
SSDEEP
24576:5wYmUe656qGLoorvPS3PnvH6gacnCW+NKkzPCij4+G/tN8+LBaAXu5w2iBzl:5tn6qGLPS/nvdaFNKqPCOSN17+53kzl
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
ca5a39ce2bddef5588b96d9e2d0b2d6c5a29b81112df3f6c346d62dd0e0b171c.exe windows x86
7e9fb7ff05f88199584269ad14f8adc5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasGetConnectStatusA
winmm
midiOutUnprepareHeader
ws2_32
inet_ntoa
kernel32
GetProcAddress
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetForegroundWindow
MessageBoxA
gdi32
SetROP2
winspool.drv
DocumentPropertiesA
advapi32
RegQueryValueA
shell32
ShellExecuteA
ole32
CLSIDFromString
oleaut32
RegisterTypeLi
comctl32
ImageList_Destroy
oledlg
ord8
wininet
HttpQueryInfoA
comdlg32
ChooseFontA
Sections
.text Size: - Virtual size: 737KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1001KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 365KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 353KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp1 Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE