Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
50c1e8df73c95943551d862ac8e58ff6a064a3b17cbc841d97589cb1a2e51376.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
50c1e8df73c95943551d862ac8e58ff6a064a3b17cbc841d97589cb1a2e51376.exe
Resource
win10v2004-20220812-en
General
-
Target
50c1e8df73c95943551d862ac8e58ff6a064a3b17cbc841d97589cb1a2e51376
-
Size
5.7MB
-
MD5
b318c432e7e6baab2d606df72aed7eff
-
SHA1
4fa94dc9e67d7d27097b4f1699a65767f728eb8d
-
SHA256
50c1e8df73c95943551d862ac8e58ff6a064a3b17cbc841d97589cb1a2e51376
-
SHA512
190fad1ac03fff9b5e3270c1442900b43bc2a95ddc34b3969bf82dbb2f63f0f1eced2126d0f3947128fb504154982f48acf2c16e09312c5a3bc6b2cc16f6e5b0
-
SSDEEP
98304:gi3r5p6X9ns1Os7qxPniZb7Ieiqs9DCRKOypL7SxMeSiyDM/qW:h3ruy/W5niuei/9DCRKOOuxMx+q
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
50c1e8df73c95943551d862ac8e58ff6a064a3b17cbc841d97589cb1a2e51376.exe windows x86
46c433d73eba05e8fe12aef750b53216
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetDC
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
DeleteObject
shlwapi
PathFindExtensionW
gdiplus
GdipSaveImageToFile
wininet
HttpEndRequestA
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 545KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.7MB - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ