Behavioral task
behavioral1
Sample
211e56cfebf1079ff07d76a303bce1835b6fbc17d84ae5f7c81bce6bfba3ec4f.exe
Resource
win10v2004-20230220-en
General
-
Target
211e56cfebf1079ff07d76a303bce1835b6fbc17d84ae5f7c81bce6bfba3ec4f
-
Size
3.8MB
-
MD5
223a3193b04f2b5564495839f5bfb834
-
SHA1
b4fe59e6ec8bdf5dbf0d4a34e42cbed269f82082
-
SHA256
211e56cfebf1079ff07d76a303bce1835b6fbc17d84ae5f7c81bce6bfba3ec4f
-
SHA512
ca94b2ea6971864b399bd73111e4993d25c2675207abc9900c408ff614e63a53398c7e4c778f1043bd63baca2cb077a6fc2783f872263ce8cf3efca11ecd09da
-
SSDEEP
98304:P+xmA/JbNccZe2TOrilHmUuxnBXzZkHmOB:U13ccZbWPllam
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
211e56cfebf1079ff07d76a303bce1835b6fbc17d84ae5f7c81bce6bfba3ec4f.exe windows x86
d3b5af061cdc20768c148c4b96cb15ed
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetVersion
GetACP
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CharUpperBuffW
Sections
.text Size: - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 163KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 553KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 3.8MB - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE