Behavioral task
behavioral1
Sample
ce89b36c58eb039ae11bd5be5542a1c4705d807c7a7864380695faf63093406d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ce89b36c58eb039ae11bd5be5542a1c4705d807c7a7864380695faf63093406d.exe
Resource
win10v2004-20221111-en
General
-
Target
ce89b36c58eb039ae11bd5be5542a1c4705d807c7a7864380695faf63093406d
-
Size
1.2MB
-
MD5
c4aaad5b179e81194df7da25a9f3ab5d
-
SHA1
db5443e95ebfaf5ea88f67843f627a38d0a0f4c7
-
SHA256
ce89b36c58eb039ae11bd5be5542a1c4705d807c7a7864380695faf63093406d
-
SHA512
9f4905c7f2c107faa354bfd267e8d8af45141480574cf85fc7f8eae189a41436a634536f79e0465684d70429c965d0b4a26638e0d8ef99900cd820a7e85c60a9
-
SSDEEP
24576:moS50Th81Xm48b5KE3EgGmMiAB8eAjaZbYXunGbGymdCmKtD9yYy+cxwyoNngJ:s5wmtW5nXMYerKuGZmbKzyYy+cSBgJ
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
ce89b36c58eb039ae11bd5be5542a1c4705d807c7a7864380695faf63093406d.exe windows x86
27e71ec3d91c046f78f6b5c1d649efd5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord1776
msvcrt
_except_handler3
kernel32
HeapReAlloc
GetCurrentProcess
LocalAlloc
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EnableWindow
CharUpperBuffW
CharUpperBuffW
gdi32
GetStockObject
wtsapi32
WTSSendMessageW
WTSSendMessageW
advapi32
RegQueryValueExA
OpenSCManagerW
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
Sections
.text Size: - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1023KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 646KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 858KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 692B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ