Behavioral task
behavioral1
Sample
@qQU0$Go2oMT0N8w+[#.exe
Resource
win10v2004-20220812-en
General
-
Target
@qQU0$Go2oMT0N8w+[#.exe
-
Size
1023KB
-
MD5
f0ae43c928edb12353e354994bb6b53c
-
SHA1
8a8a372d3ecd0cdd916d50a496728d885a70efc9
-
SHA256
514c8afc9967cdf5c5afb64ad733915a1d7c5806372ed94a787c226699833d62
-
SHA512
f20b44afd3b67e3bd602016f1ec5669e7aec6ee212efa121f2c070494837ab8582c25f9e3c81680280eadfc67fa729bd6e1d5749c99618b47261f2d189dbdd9d
-
SSDEEP
24576:4Wb4E0+NU15/1qUIzWi+s4qcaG9BscgjFeFrG5nmVz1Sb:484COH/5Kd+s1p/jyC5nmVz1W
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
@qQU0$Go2oMT0N8w+[#.exe.exe windows x86
6295c99c04a65c2f100bbb8de64a5397
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
CreateRemoteThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
DefWindowProcA
shell32
ShellExecuteExA
msvcp100
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
psapi
GetModuleFileNameExA
iphlpapi
GetAdaptersInfo
wininet
InternetOpenA
msvcr100
__setusermatherr
Sections
.text Size: - Virtual size: 54KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 760KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 878KB - Virtual size: 878KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 264B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 143KB - Virtual size: 143KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ