Behavioral task
behavioral1
Sample
b6d606de45f89345164819223d2a5e08.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
b6d606de45f89345164819223d2a5e08.exe
Resource
win10v2004-20230220-en
General
-
Target
b6d606de45f89345164819223d2a5e08.exe
-
Size
237KB
-
MD5
b6d606de45f89345164819223d2a5e08
-
SHA1
bf4ab211a40645cdebeac961b47a70fa1728ab7f
-
SHA256
b3b9f649e48152197eb0e08c73f41fd150f9a7c8356b43d681a4054350b9f2aa
-
SHA512
dd4bb00b0777f8cd017c594b53c7f85869f9886706ceb2267b0635b118a21a5e020f9e471104e271a40a2f449d680eb009a85d3d0f34132bd0db65020484dde0
-
SSDEEP
6144:CH4j3ERSVvZrpd386J+zOlc20ppOB9kmFzG1lF:CY7ERQRrpd3y/2sOB9kmZof
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
b6d606de45f89345164819223d2a5e08.exe.exe windows x64
3be9e96716bed6603e3cb2a625904465
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CloseHandle
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
FindWindowExA
Sections
.text Size: - Virtual size: 85KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 123KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 235KB - Virtual size: 235KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 36B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ