Behavioral task
behavioral1
Sample
f2cb266917596336f6ff77fcec85c2449b03ba68e3a34bac4aa8ca9376c22c78.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f2cb266917596336f6ff77fcec85c2449b03ba68e3a34bac4aa8ca9376c22c78.exe
Resource
win10v2004-20220812-en
General
-
Target
f2cb266917596336f6ff77fcec85c2449b03ba68e3a34bac4aa8ca9376c22c78
-
Size
2.0MB
-
MD5
57772c297b5ae3b1df692cc51f86db6d
-
SHA1
9f4daa4bae6a955ba73704086df73022b8802e16
-
SHA256
f2cb266917596336f6ff77fcec85c2449b03ba68e3a34bac4aa8ca9376c22c78
-
SHA512
90e10c958b7ca240cc03baa7ba257a304b3046b6ac7c1e3ad2828c9e235cc749def7cf43eab55cf09a37706c8089f5cb33ca96b5de333407690edc74cf4defb2
-
SSDEEP
49152:yRhuAr9d0fyOL3L3eQNUiAMB7auZ+lm9/FTeY5HR78OeLoF:yZr9d0P3beQmgGuZ+0IsCOeLo
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
f2cb266917596336f6ff77fcec85c2449b03ba68e3a34bac4aa8ca9376c22c78.exe windows x86
fef97457b0c82114344e267f3ce2fcc8
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiOutReset
ws2_32
getpeername
rasapi32
RasHangUpA
kernel32
GetVersionExA
GetVersion
GetOEMCP
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GrayStringA
gdi32
GetWindowOrgEx
winspool.drv
DocumentPropertiesA
advapi32
RegQueryValueA
shell32
Shell_NotifyIconA
ole32
CLSIDFromString
oleaut32
LoadTypeLi
comctl32
ord17
wininet
HttpSendRequestA
comdlg32
GetSaveFileNameA
Sections
.text Size: - Virtual size: 554KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 244KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ