Shiesty_Support_Tool[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Shiesty_Support_Tool.exe
Size

121.9MB
MD5

ece3af7543916dd464b0dba4d6936dcb
SHA1

24a368e383103745a00057f15a68178f46508564
SHA256

394fbfa87ea6a5de5a9a27af1a8fa0feeccf0e97e1ee46b6e5d1bac5ea17d2df
SHA512

2c5cb3f6895fea5c123f116361799e5df8d8571d1cf8b0437eac35f465e5517526ec806e35fe07f833ff51fc3d954bbf7b3d7898cf44c5c183230b2050361d3b
SSDEEP

3145728:7sw86xPIJZkK2iYD6vrVA5yqfr0GZX2h7XTU5vZe:7sY5wZzYWVH4IGGh7n

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

Shiesty_Support_Tool.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: - Virtual size: 63.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 63.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 121.7MB - Virtual size: 121.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 221KB - Virtual size: 221KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ