Behavioral task
behavioral1
Sample
7e3b45d8c73116b3e17e37a7781498d23f9610a127040df8ad463d53b903dbdb.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
7e3b45d8c73116b3e17e37a7781498d23f9610a127040df8ad463d53b903dbdb.exe
Resource
win10v2004-20230220-en
General
-
Target
7e3b45d8c73116b3e17e37a7781498d23f9610a127040df8ad463d53b903dbdb
-
Size
2.1MB
-
MD5
f3b85f4e506dcae2041e10a8019e4799
-
SHA1
c4a6027c8818746a222418b853b047a6b4ef3aea
-
SHA256
7e3b45d8c73116b3e17e37a7781498d23f9610a127040df8ad463d53b903dbdb
-
SHA512
6c32ac0ecb82b843de4d3b0dd9961acb8832620b13eefb58803a90e3f74b6275a9e43a3911cc8bede73da5d75ef4f7889702fbadcb3ada22479e7fc4cdd45dd7
-
SSDEEP
49152:s2Qo9Z6xixzrLSACTplSwJZuERogHkYl/ez5gp:SKAVvW6ogE
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
7e3b45d8c73116b3e17e37a7781498d23f9610a127040df8ad463d53b903dbdb.exe windows x86
087c3632fa0b78058e652bbeddad2c7a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasHangUpA
kernel32
CreateToolhelp32Snapshot
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MapWindowPoints
gdi32
Ellipse
winmm
midiOutPrepareHeader
winspool.drv
DocumentPropertiesA
advapi32
RegSetValueExA
shell32
SHGetSpecialFolderPathA
ole32
CreateILockBytesOnHGlobal
oleaut32
LoadTypeLi
comctl32
ImageList_Duplicate
oledlg
ord8
ws2_32
getpeername
wininet
InternetCloseHandle
comdlg32
GetFileTitleA
Sections
.text Size: - Virtual size: 725KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 273KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 833KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ