4b9dd537d7ec7ca64f866b4467c8f5bbf75938fea19047144f111dfddbb53a66

General

Target
4b9dd537d7ec7ca64f866b4467c8f5bbf75938fea19047144f111dfddbb53a66
Size 4.2MB
Sample221127-ecb9wabf7x
SHA256 4b9dd537d7ec7ca64f866b4467c8f5bbf75938fea19047144f111dfddbb53a66
MD5 a1eb5c19addcdb44ed88f4cd7ce9c547
SHA1 e70a4a83df0b36d3a5e7d6b64a8a37cd5e26de92
SHA512 24f24143c45bc9d51dc95e64e6166e4ab73aba7b05f3e5e5f15253a40d82471015e1dcd33d1960cd3754ff2e4d303fb8fc0c7bd1782f75f47167305e5f1ea1a8
SSDEEP 98304:sOttY/gBBQ2uGvu4Al8NnBE3BGeHLmY398/PsVs1ooLp463f8m:sOP8go2upDAK3MVa9lVsooLS6v/
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
static1/unpack001/镇魂勇士的信仰辅助二代V1 0/镇魂勇士的信仰辅助V1.6版本最新版.exe	vmprotect

File Explorer

4b9dd537d7ec7ca64f866b4467c8f5bbf75938fea19047144f111dfddbb53a66

.rar 4.2MB
镇魂勇士的信仰辅助二代V1 0/打开辅助前请看.txt

328B
镇魂勇士的信仰辅助二代V1 0/镇魂勇士的信仰辅助V1.6版本最新版.exe

.exe 4.3MB

4b9dd537d7ec7ca64f866b4467c8f5bbf75938fea19047144f111dfddbb53a66

SHA256 4b9dd537d7ec7ca64f866b4467c8f5bbf75938fea19047144f111dfddbb53a66
MD5 a1eb5c19addcdb44ed88f4cd7ce9c547
SHA1 e70a4a83df0b36d3a5e7d6b64a8a37cd5e26de92
SHA512 24f24143c45bc9d51dc95e64e6166e4ab73aba7b05f3e5e5f15253a40d82471015e1dcd33d1960cd3754ff2e4d303fb8fc0c7bd1782f75f47167305e5f1ea1a8
SSDEEP 98304:sOttY/gBBQ2uGvu4Al8NnBE3BGeHLmY398/PsVs1ooLp463f8m:sOP8go2upDAK3MVa9lVsooLS6v/
MD5 SHA1 SHA512 SSDEEP

镇魂勇士的信仰辅助二代V1 0/镇魂勇士的信仰辅助V1.6版本最新版.exe

IMPHASH 0917b40122c02d0fe7fc2cfc658d4893
SHA256 1ca766cf11ebf742845e34d433b93bdd82b2e6c14ae2cf4ce43a4db3ff284c06
MD5 d7e71e867ec10ae2e7c6998ab59dc2f6
SHA1 53ed40bb480eff2f003ec01b4852cb8beb70b569
SHA512 47ff798782e758bad126aa1c757e31e8706d9adfe756bb261addb0dad1e828a17db319aaf11e619659802a6ac0ea6e914a7eb4032480f666af69b3cd0be980fb
SSDEEP 98304:1XPTAMPmUq0V0Rv5sq+AoWxHnjYL0OjyhZLIvRuvRiy:1fD+/w0Rhs4zYQOuzIvRuvRf
MD5 SHA1 SHA512 SSDEEP

windows x86

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect

Minor OS version

Major OS version

Entry point

7158235

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

415KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

Virtual Size

869KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp1

Size

4.3MB

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

16KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

4b9dd537d7ec7ca64f866b4467c8f5bbf75938fea19047144f111dfddbb53a66

镇魂勇士的信仰辅助二代V1 0/打开辅助前请看.txt

镇魂勇士的信仰辅助二代V1 0/镇魂勇士的信仰辅助V1.6版本最新版.exe

winmm

ws2_32

rasapi32

kernel32

user32

gdi32

winspool.drv

comdlg32

advapi32

shell32

ole32

oleaut32

comctl32

oledlg

wininet

Sharing

General

Malware Config

Signatures

File Explorer

4b9dd537d7ec7ca64f866b4467c8f5bbf75938fea19047144f111dfddbb53a66

镇魂勇士的信仰辅助二代V1 0/打开辅助前请看.txt

镇魂勇士的信仰辅助二代V1 0/镇魂勇士的信仰辅助V1.6版本最新版.exe

winmm

ws2_32

rasapi32

kernel32

user32

gdi32

winspool.drv

comdlg32

advapi32

shell32

ole32

oleaut32

comctl32

oledlg

wininet