ImGuiLauncher[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

ImGuiLauncher.exe
Size

7.4MB
MD5

d62c012ac06b3a6df7166c944b2289f7
SHA1

8860fd5e7aa8c967a8e26c169d0e4dc8554548eb
SHA256

bfab9816112f5d508edd5328898e62bd1161570d946843e74e4cd018f8dc4afc
SHA512

6890a4d6e736fc2f76dc618f27699676aa402d01f25f7f713d0d7c09017a997454481268350db236f193ef77a029a7bc2893138f88fb07820331e3086d174db1
SSDEEP

196608:WHjxrCG7LPfDQEtbx45bxq+cV+Ji5Yn3+MUCt+z:WlNrfDXy5bxuuEY3Ew+

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

ImGuiLauncher.exe
.exe windows x64

9ed0801fc3d830036f743f878bb6ba62

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

QueryPerformanceCounter
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

GetAsyncKeyState
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW

advapi32

CryptEncrypt

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

oleaut32

SysAllocString

msvcp140

?always_noconv@codecvt_base@std@@QEBA_NXZ

ntdll

RtlCaptureContext

normaliz

IdnToAscii

ws2_32

socket

wldap32

ord45

crypt32

CertEnumCertificatesInStore

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

xinput1_4

ord4

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-runtime-l1-1-0

strerror

api-ms-win-crt-stdio-l1-1-0

fsetpos

api-ms-win-crt-heap-l1-1-0

calloc

api-ms-win-crt-filesystem-l1-1-0

_unlock_file

api-ms-win-crt-string-l1-1-0

strspn

api-ms-win-crt-convert-l1-1-0

strtod

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-time-l1-1-0

_gmtime64

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func

api-ms-win-crt-math-l1-1-0

cosf

wtsapi32

WTSSendMessageW

Sections

.text
Size: - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 193KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 5.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 7.4MB - Virtual size: 7.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 200B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 476B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9ed0801fc3d830036f743f878bb6ba62

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

msvcp140

ntdll

normaliz

ws2_32

wldap32

crypt32

d3d11

dwmapi

imm32

d3dcompiler_47

xinput1_4

vcruntime140_1

vcruntime140

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

wtsapi32

Sections

.text Size: - Virtual size: 1.1MB

.rdata Size: - Virtual size: 193KB

.data Size: - Virtual size: 25KB

.pdata Size: - Virtual size: 36KB

.vmp0 Size: - Virtual size: 5.1MB

.vmp1 Size: 7.4MB - Virtual size: 7.4MB

.reloc Size: 512B - Virtual size: 200B

.rsrc Size: 512B - Virtual size: 476B

.text
Size: - Virtual size: 1.1MB

.rdata
Size: - Virtual size: 193KB

.data
Size: - Virtual size: 25KB

.pdata
Size: - Virtual size: 36KB

.vmp0
Size: - Virtual size: 5.1MB

.vmp1
Size: 7.4MB - Virtual size: 7.4MB

.reloc
Size: 512B - Virtual size: 200B

.rsrc
Size: 512B - Virtual size: 476B