Behavioral task
behavioral1
Sample
PBZepetto (Mr.Cheats).exe
Resource
win10v2004-20220812-en
General
-
Target
PBZepetto (Mr.Cheats).exe
-
Size
1.3MB
-
MD5
f2fbe7602c13e53b69c7de0ec2df0833
-
SHA1
186fc434946077685a7f02940967771062a5c28c
-
SHA256
9daf8dc4cabee09c583ae32640f19f25636341087a388a0d5f2ec796007f232b
-
SHA512
14b93156efae438bb5b6197b45ca80ca54a31e05d89513325d3175cd243dec49743fc1a39e1d960e34e2680f6cf1b5c5fb89cda6666fde3f6a4cd0de5c69bb01
-
SSDEEP
24576:nnRa+37M3Bp09NgtknGYeCJaXpYup1A9fz+NBSQtoFhh4D/Nt5Xc5MFEYBFo:nncAM3b6StknY1A9CroTQVq8
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
PBZepetto (Mr.Cheats).exe.exe windows x86
8aead044b25684d274fc1b98eb3e126f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaStrErrVarCopy
kernel32
GetCurrentProcessId
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxW
Sections
.text Size: - Virtual size: 277KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 997KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 180KB - Virtual size: 178KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ