SecuriteInfo[.]com[.]Trojan[.]GenericKD[.]64834682[.]13016[.]3433[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

SecuriteInfo.com.Trojan.GenericKD.64834682.13016.3433.exe
Size

6.7MB
MD5

4b9e8b2f3ea2608442a84b93c3b04545
SHA1

8b4d08b15fc86adf6c7783b8e88cd313f012674e
SHA256

f96864b6f9c6af50b4f71073ea5396e96c5b80bc3024a1531064f43b34497d12
SHA512

0248bee7ba26dcbd086a9c719b8463e013e0121ebcfe3b70f04fb7cd99f2e3da54b243aed3c1e59f7df9fd54717d153999f72a58f53dddcfc757a9ccbb85d811
SSDEEP

196608:7ZH239wkNJymM3IhIKrO1lrG6uFuCkSZnb7d:NH239zTywng8J1Zb7d

Score

8^/10

vmprotect themida

Malware Config

Signatures

VMProtect packed file 1 IoCs
Detects executables packed with VMProtect commercial packer.
vmprotect

Processes:

resource yara_rule

sample vmprotect
Themida packer 1 IoCs
Detects Themida, an advanced Windows software protection system.
themida

Processes:

resource yara_rule

sample themida

resource	yara_rule
sample	vmprotect

resource	yara_rule
sample	themida

Files

SecuriteInfo.com.Trojan.GenericKD.64834682.13016.3433.exe
.exe windows x86

a4308f82c6f6f467c58289d16d7acab2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

CharNextA

advapi32

RegCloseKey

shell32

ShellExecuteA

ole32

CoCreateInstance

Sections

Size: 842KB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 74KB - Virtual size: 168KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 4KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: 372KB - Virtual size: 372KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 27KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.themida
Size: - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp2
Size: 512B - Virtual size: 460B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp3
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_MEM_READ

.rsrc
Size: 372KB - Virtual size: 372KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a4308f82c6f6f467c58289d16d7acab2

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

Sections

Size: 842KB - Virtual size: 2.0MB

Size: 74KB - Virtual size: 168KB

Size: 4KB - Virtual size: 34KB

.vmp0 Size: 372KB - Virtual size: 372KB

Size: 27KB - Virtual size: 41KB

.idata Size: 512B - Virtual size: 4KB

.tls Size: 512B - Virtual size: 4KB

.themida Size: - Virtual size: 2.5MB

.boot Size: 1.5MB - Virtual size: 1.5MB

.vmp1 Size: 1.3MB - Virtual size: 1.3MB

.vmp2 Size: 512B - Virtual size: 460B

.vmp3 Size: 2.2MB - Virtual size: 2.2MB

.reloc Size: 3KB - Virtual size: 2KB

.rsrc Size: 372KB - Virtual size: 372KB

.vmp0
Size: 372KB - Virtual size: 372KB

.idata
Size: 512B - Virtual size: 4KB

.tls
Size: 512B - Virtual size: 4KB

.themida
Size: - Virtual size: 2.5MB

.boot
Size: 1.5MB - Virtual size: 1.5MB

.vmp1
Size: 1.3MB - Virtual size: 1.3MB

.vmp2
Size: 512B - Virtual size: 460B

.vmp3
Size: 2.2MB - Virtual size: 2.2MB

.reloc
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 372KB - Virtual size: 372KB