forum_62f45c3f3825e_下发结算报表x[.]zip

Resubmissions

03-10-2022 14:54

221003-r9zsnabga8 8

13-08-2022 08:37

220813-kjjkesfgfp 8

Sharing

Copy URL

Twitter E-mail

General

Target

forum_62f45c3f3825e_下发结算报表x.zip
Size

1.9MB
MD5

3a7a832f6a7d5c8093566c0783edd4f4
SHA1

0d0f1759a1d2f6bc389d70d12e34c56427f85ce5
SHA256

ffaf67e89ab49855c55ed072986c4f6d44a1dc741a160cf8c092a5a488bebd2b
SHA512

206cd06309c5a3a0933d8cd1c516d12bf53c1d66041b8a861d29279ac1d937fa4294c0c17171e0b3be5a2f9aad322107cf7837803de9fbca9b13968efa77cd32
SSDEEP

24576:1XQfAXuCnt+N/pIkmp7wwVeH2lepqVrPrEg8zayyqDkwg6fzkWzbfkUjHB1Me:1g0tWB7mpVKSrjEJayy25gozkWnfp

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
static1/unpack001/下发结算报表x.exe	vmprotect

Files

forum_62f45c3f3825e_下发结算报表x.zip
.zip
下发结算报表x.exe
.exe windows x86

81883e3f5a1c2644e62c72e8929ecbe8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcp140

??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ

kernel32

WriteFile
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

IsWindowVisible

advapi32

RegOpenKeyExW

ole32

CoUninitialize

oleaut32

SafeArrayUnaccessData

mscoree

CorBindToRuntimeEx

vcruntime140

memset

api-ms-win-crt-stdio-l1-1-0

fgetpos

api-ms-win-crt-filesystem-l1-1-0

_lock_file

api-ms-win-crt-runtime-l1-1-0

_get_initial_narrow_environment

api-ms-win-crt-heap-l1-1-0

malloc

api-ms-win-crt-string-l1-1-0

strtok

api-ms-win-crt-utility-l1-1-0

srand

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

ws2_32

WSAStartup

Sections

.text
Size: - Virtual size: 94KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 277KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 752KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 773KB - Virtual size: 772KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

81883e3f5a1c2644e62c72e8929ecbe8

Headers

DLL Characteristics

File Characteristics

Imports

msvcp140

kernel32

user32

advapi32

ole32

oleaut32

mscoree

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

ws2_32

Sections

.text Size: - Virtual size: 94KB

.rdata Size: 34KB - Virtual size: 34KB

.data Size: - Virtual size: 277KB

.vmp0 Size: - Virtual size: 752KB

.vmp1 Size: 2.3MB - Virtual size: 2.3MB

.reloc Size: 2KB - Virtual size: 2KB

.rsrc Size: 773KB - Virtual size: 772KB

.text
Size: - Virtual size: 94KB

.rdata
Size: 34KB - Virtual size: 34KB

.data
Size: - Virtual size: 277KB

.vmp0
Size: - Virtual size: 752KB

.vmp1
Size: 2.3MB - Virtual size: 2.3MB

.reloc
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 773KB - Virtual size: 772KB