Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220901-en
General
-
Target
file.exe
-
Size
5.0MB
-
MD5
433b813e066ee7ab3f5f11015705b659
-
SHA1
0cdaa0a0d51edf0c34ac3ae43c458c7d1365e0a4
-
SHA256
a2f49d7bc1d0f299da6b59cfa653df073ff74b841cae265520c87a920367bf11
-
SHA512
baab91c34273d0e550659f134bb32b77674da7dd6419aa13de5b65bdbd9bef7d5975db48ffd4e0cda3b0ec5114bbeea2b8f17d7a48290ca7dbcfc3996d41422e
-
SSDEEP
98304:QwJ+BQSw6qvay3FK305/Bk6N1RKPEL15D7gDlk+C/eWK3oorad92TyGofF:jJWQSwz3YR6N1GELH3gDsGWK3RUGc
Malware Config
Signatures
-
Processes:
resource yara_rule sample vmprotect
Files
-
file.exe.exe windows x86
f51724e08a085aa5e9f0970616ead7ad
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetDesktopWindow
GetProcessWindowStation
GetUserObjectInformationW
gdi32
CreateCompatibleBitmap
advapi32
SystemFunction036
shell32
SHGetFolderPathA
crypt32
CryptUnprotectData
gdiplus
GdipGetImageEncodersSize
setupapi
SetupDiGetDeviceInterfaceDetailA
Sections
.text Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 163KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 4.8MB - Virtual size: 4.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 190KB - Virtual size: 2.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ