Fusion_p[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

Fusion_p.exe
Size

5.9MB
MD5

2b6fc0fa23c6839f51fe4b6ff621df5b
SHA1

cde4e74f349d268fb4cd1f79b530168023c1e9fc
SHA256

e35300168a77b9bdfae51023350fedc6e57709a829b1a20ee2175ef3795f6426
SHA512

d51b29048ae8c06add6a22e94886b77298245fb7eafe49a7f49282cebac537a2845793797474913705c083345e36389efd328b1b42fdd2bdbbd85ab74e152ea1
SSDEEP

98304:3Rl4uvwLmas8pu9neZtYyUFw2G9C4pMrHLguAtsj09rqZ77Aczg1:3RmuYqas8puWtBUK2oCAuAE09rqZHPz

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

Fusion_p.exe
.exe windows x64

bf7dfaf96d50d5ae9447f2bbd91a8093

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcp140d

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ

vcruntime140d

memcmp

vcruntime140_1d

__CxxFrameHandler4

ucrtbased

_CrtDbgReportW

kernel32

GetCurrentThreadId
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

wtsapi32

WTSSendMessageW

user32

GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW

Sections

.textbss
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: - Virtual size: 146KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.msvcjmc
Size: - Virtual size: 562B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: - Virtual size: 373B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 4.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 5.9MB - Virtual size: 5.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 469B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bf7dfaf96d50d5ae9447f2bbd91a8093

Headers

DLL Characteristics

File Characteristics

Imports

msvcp140d

vcruntime140d

vcruntime140_1d

ucrtbased

kernel32

wtsapi32

user32

Sections

.textbss Size: - Virtual size: 64KB

.text Size: - Virtual size: 146KB

.rdata Size: - Virtual size: 47KB

.data Size: - Virtual size: 3KB

.pdata Size: - Virtual size: 15KB

.idata Size: - Virtual size: 11KB

.msvcjmc Size: - Virtual size: 562B

.00cfg Size: - Virtual size: 373B

.vmp0 Size: - Virtual size: 4.0MB

.vmp1 Size: 5.9MB - Virtual size: 5.9MB

.reloc Size: 512B - Virtual size: 216B

.rsrc Size: 512B - Virtual size: 469B

.textbss
Size: - Virtual size: 64KB

.text
Size: - Virtual size: 146KB

.rdata
Size: - Virtual size: 47KB

.data
Size: - Virtual size: 3KB

.pdata
Size: - Virtual size: 15KB

.idata
Size: - Virtual size: 11KB

.msvcjmc
Size: - Virtual size: 562B

.00cfg
Size: - Virtual size: 373B

.vmp0
Size: - Virtual size: 4.0MB

.vmp1
Size: 5.9MB - Virtual size: 5.9MB

.reloc
Size: 512B - Virtual size: 216B

.rsrc
Size: 512B - Virtual size: 469B