Static

static

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    File.zip

  • Size

    6.2MB

  • MD5

    8b5849685685a8e23b6b4bc6a2c66539

  • SHA1

    c25becc2ee6e56687050ca937a223b46dcb9d017

  • SHA256

    48fd696c3cdb17f595ce09e31aa04e1ebb55572df931c1e51e70e1f954b8bf41

  • SHA512

    c568b91704471e9b89af9639c029b6c2cc2e1b5d2a1c30fd12f5774ddd0894635af5e6579fc71304f69f1d29a79f8df119d145f4c27a1114bf8a3248a474db49

  • SSDEEP

    98304:CxNcuhRf3JQZNGskk3Ae60H9xtZvrUzuJUU5pNqNHB9y8smj/Q/uv2e9:C3LmukBddzxt5pNCB9s+Q/uvz

Score
8/10
vmprotect

Malware Config

Signatures

  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect

Files

  • File.zip
    .zip

    Password: 1234

  • Install.exe
    .exe windows x86

    Password: 1234

    f540b6d6dcfc33b21d0deb0ccba24751


    Code Sign

    Headers

    Imports

    Sections

  • advapi32.dll
    .dll windows x64

    Password: 1234

    4413d04a36ee067d7ec8c1eb660aa1c9


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • advapi32res.dll
    .dll windows x64

    Password: 1234


    Headers

    Sections

  • fonts/Alakob.ttf
  • fonts/AlaskanNights.ttf
  • fonts/Arggotsc.ttf
  • fonts/Army Condensed.ttf
  • fonts/Army Thin.ttf
  • fonts/BELL.TTF
  • fonts/BELLB.TTF
  • fonts/BELLI.TTF
  • fonts/BOD_BI.TTF
  • fonts/BOD_BLAI.TTF
  • fonts/BOD_I.TTF
  • fonts/CALISTB.TTF
  • fonts/CALISTBI.TTF
  • fonts/CENTAUR.TTF
  • fonts/Cabana-Regular.ttf
  • fonts/baby_csp.ttf
  • fonts/black.ttf
  • fonts/bold_0.ttf
  • fonts/browa.ttf
  • fonts/browau.ttf
  • fonts/browauz.ttf
  • fonts/browaz.ttf
  • fonts/deathrattlebb_reg.ttf
  • langs/Arabic.ini
  • langs/Belarusian.ini
  • langs/Bulgarian.ini
  • langs/Croatian.ini
  • langs/Czech.ini
  • langs/Danish.ini
  • langs/English.ini
  • langs/Farsi.ini
  • langs/Finnish.ini
  • langs/Hebrew.ini
  • langs/Hindi.ini
  • langs/Hungarian.ini
    .ps1
  • langs/Indonesian.ini
  • langs/Japanese.ini
  • langs/Kazakh.ini
  • langs/Korean.ini
    .ps1
  • langs/Kurdish.ini
  • langs/Lithuanian.ini
  • langs/Norwegian.ini
  • langs/Russian.ini
  • langs/SimpChinese.ini
  • langs/Sinhala.ini
  • langs/Slovak.ini
  • langs/Swedish.ini
  • langs/Thai.ini
  • langs/TradChinese.ini
  • langs/Ukrainian.ini
  • langs/Uyghur.ini
  • langs/UyghurLatin.ini
  • langs/Uzbek.ini
  • langs/Vietnamese.ini