Behavioral task
behavioral1
Sample
XMP_VIP_V1.8.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
XMP_VIP_V1.8.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
更多软件下载.url
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
更多软件下载.url
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
飘荡软件.url
Resource
win7-20220901-en
Behavioral task
behavioral6
Sample
飘荡软件.url
Resource
win10v2004-20220901-en
General
-
Target
68aa4ef4d15e50bf2f0bd1b56b294f19505cce0dd224f26e1e3ec449a09957cb
-
Size
2.5MB
-
MD5
264d5d57985aaa01dd3123a853db8001
-
SHA1
cea132dc94bd408f87170165be264c59166e2331
-
SHA256
68aa4ef4d15e50bf2f0bd1b56b294f19505cce0dd224f26e1e3ec449a09957cb
-
SHA512
43ea65ace284f577c0f3ee9954d24eadb5059898254542de531dc2881150e2c8a8cc7071372532498c0b0c9f97d00c7bc0b59b37d2b8f61feb2e36302b927a66
-
SSDEEP
49152:dSM2zFneP+M1rq6B52nh4UFRNjdfiNSdxjoN4LG6JtaDTj/VlI2jdVF7GDQd:d+zFneL1/2n2UFRtFsCdG6Jtr2Dl
Malware Config
Signatures
-
resource yara_rule static1/unpack001/XMP_VIP_V1.8.exe vmprotect
Files
-
68aa4ef4d15e50bf2f0bd1b56b294f19505cce0dd224f26e1e3ec449a09957cb.rar
-
XMP_VIP_V1.8.exe.exe windows x86
b1de38c29d0ddc3f37a082c754fc00fb
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutReset
ws2_32
recv
rasapi32
RasGetConnectStatusA
kernel32
EnumResourceNamesW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
RemovePropA
gdi32
GetPixel
msimg32
GradientFill
winspool.drv
DocumentPropertiesA
advapi32
RegQueryValueExA
shell32
SHGetPathFromIDListA
ole32
StgCreateDocfileOnILockBytes
oleaut32
SafeArrayGetDim
comctl32
ImageList_GetIcon
oledlg
ord8
wininet
InternetOpenA
comdlg32
GetSaveFileNameA
Sections
.text Size: - Virtual size: 653KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 311KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 874KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
更多软件下载.url.url
-
飘荡软件.url.url