interium[.]rar

Resubmissions

15/01/2023, 00:36 UTC

230115-aybg9abe6s 8

15/01/2023, 00:11 UTC

230115-agp93sfe58 8

15/01/2023, 00:06 UTC

230115-ad4y3abc3t 8

Sharing

Copy URL

Twitter E-mail

General

Target

interium.rar
Size

14.5MB
MD5

81b60c6e7141465635226d21723a9df8
SHA1

f3767058e15bc105966717a7aee3cc6f011cd8b3
SHA256

6413b835503a6c77f347a262f0ce18de15ea59608658aa8c2e51a3433ffe1624
SHA512

72a8b78e44fc3e28ec689917c5ec912caf6c2e17d3d162c7880cb80f3a82077e60f2db0f9a74183e1e8871852ff0fdc9e2d223c46d2793572710ed3612531402
SSDEEP

196608:M7Xj8bBRci2CjBJ+RonUoQ3h4AnhRyZjZU/mqQxG38rQF+DaMJTnsyMf7d8zb1tb:MTj81l2ClJ+IUoQ37c1U/OYll4QgRh

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
static1/unpack001/interium/crack/v4.dll	vmprotect

Files

interium.rar
.rar
interium/README.txt
interium/crack/Cracked by suga, QHide, SATANIZMOV
interium/crack/injmthd.ini
interium/crack/v4.dll
.dll windows x86

02ebac4065677513be1f02fc32b266b7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalUnlock
LocalAlloc
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

mouse_event
GetProcessWindowStation
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW

advapi32

RegOpenKeyExA

shell32

ShellExecuteA

opengl32

glTexEnvi

ws2_32

WSACleanup

wininet

InternetOpenA

urlmon

URLDownloadToFileA

imm32

ImmSetCompositionWindow

wtsapi32

WTSSendMessageW

Sections

.text
Size: - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 238KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: - Virtual size: 3.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.0
Size: - Virtual size: 9.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.1
Size: 14.7MB - Virtual size: 14.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 233B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
interium/crack/v4.exe
.exe windows x86

93d810b01b97ce9d6eaa290650e30a49

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameA
Process32First
SetFileTime
Thread32Next
SuspendThread
ResumeThread
GetModuleHandleA
CreateToolhelp32Snapshot
MultiByteToWideChar
GetExitCodeThread
Sleep
GetFileAttributesA
CreateFileA
Process32Next
CloseHandle
GetProcAddress
VirtualAllocEx
SystemTimeToFileTime
GetSystemTime
VirtualFreeEx
GetFileTime
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter

ntdll

NtWriteVirtualMemory
RtlCreateUserThread
RtlAdjustPrivilege
NtClose
NtOpenProcess
memset
NtWaitForSingleObject

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 804B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 172B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
interium/settings/Golyb0u_No_Psalo/legitbot.ini
interium/settings/Golyb0u_No_Psalo/misc.ini
interium/settings/Golyb0u_No_Psalo/visuals.ini
interium/settings/Golyb0u_SemiLegit/legitbot.ini
interium/settings/Golyb0u_SemiLegit/misc.ini
interium/settings/Golyb0u_SemiLegit/visuals.ini
interium/settings/Golybou_SemiRage/legitbot.ini
interium/settings/Golybou_SemiRage/misc.ini
interium/settings/Golybou_SemiRage/visuals.ini
interium/settings/Legit/legitbot.ini
interium/settings/Legit/misc.ini
interium/settings/Legit/visuals.ini
interium/settings/Путь для извлечения.txt

Resubmissions

Sharing

General

Malware Config

Signatures

Files

02ebac4065677513be1f02fc32b266b7

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

opengl32

ws2_32

wininet

urlmon

imm32

wtsapi32

Sections

.text Size: - Virtual size: 1.0MB

.rdata Size: - Virtual size: 238KB

.data Size: - Virtual size: 70KB

.vmp0 Size: - Virtual size: 1.6MB

.vmp1 Size: - Virtual size: 3.8MB

.0 Size: - Virtual size: 9.0MB

.1 Size: 14.7MB - Virtual size: 14.7MB

.reloc Size: 2KB - Virtual size: 1KB

.rsrc Size: 512B - Virtual size: 233B

93d810b01b97ce9d6eaa290650e30a49

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ntdll

Sections

.text Size: 1KB - Virtual size: 1KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 804B

.reloc Size: 512B - Virtual size: 172B

We care about your privacy.

.text
Size: - Virtual size: 1.0MB

.rdata
Size: - Virtual size: 238KB

.data
Size: - Virtual size: 70KB

.vmp0
Size: - Virtual size: 1.6MB

.vmp1
Size: - Virtual size: 3.8MB

.0
Size: - Virtual size: 9.0MB

.1
Size: 14.7MB - Virtual size: 14.7MB

.reloc
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 233B

.text
Size: 1KB - Virtual size: 1KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 804B

.reloc
Size: 512B - Virtual size: 172B