vmde64[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

vmde64.exe
Size

19KB
MD5

257cc8436cb2b5bc2881ec9027c3a95b
SHA1

891bae6b739b0bd005e5ec5a269ead55d243a06d
SHA256

fdb4ca6e8db1f4392345cdb57e5bd3fe4b6ba417cf6cdaf1ae75c38af1c0fb8d
SHA512

ec3edafe46c9c426eb34155b225af9c6141b9c6adde93e40275f8fab2d13a65737dc5732935990ceb714c93e2ad78c724451c6573f02de783b1d891df2155075
SSDEEP

384:Suq/QsuWwB2QeEtd/Evhp6UjcE+2TKXAZ:IQsFwB/tdIp6UoVXAZ

Score

N/A

Malware Config

Signatures

Files

vmde64.exe
.exe windows x64

fcc9e341872e15580f8f3d6d0c406d60

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

HeapAlloc
GetCurrentProcess
HeapFree
OutputDebugStringW
GetProcessHeap
CloseHandle
GetCurrentProcessId
ExitProcess
GetNativeSystemInfo
GetSystemInfo
CreateMutexW
GetLastError
SetLastError
RtlCompareMemory
TerminateProcess
SetUnhandledExceptionFilter
RtlUnwindEx
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetSystemTimeAsFileTime
GetCurrentThreadId
IsDebuggerPresent
IsProcessorFeaturePresent
QueryPerformanceCounter

user32

MessageBoxW
GetDesktopWindow

ntdll

NtOpenProcess
NtOpenProcessToken
CsrGetProcessId
NtCreateFile
NtQueryDirectoryObject
NtAdjustPrivilegesToken
RtlGetVersion
NtQueryVirtualMemory
NtOpenDirectoryObject
NtClose
RtlInitUnicodeString
NtOpenKey
NtEnumerateKey
NtQueryObject
NtQuerySystemInformation
NtReadVirtualMemory

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 408B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.poi
Size: 512B - Virtual size: 66B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fcc9e341872e15580f8f3d6d0c406d60

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

ntdll

Sections

.text Size: 9KB - Virtual size: 8KB

.rdata Size: 5KB - Virtual size: 5KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 512B - Virtual size: 408B

.poi Size: 512B - Virtual size: 66B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 16B

.text
Size: 9KB - Virtual size: 8KB

.rdata
Size: 5KB - Virtual size: 5KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 512B - Virtual size: 408B

.poi
Size: 512B - Virtual size: 66B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 16B