6e494069f55de7049a5699dd72301b4b[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
6e494069f55de7049a5699dd72301b4b.exe
Size 5.5MB
Sample230223-dwb8jsgd7z
SHA256 49d4689b5641b161f0ab00aa490ea276fcab2128cb33d802fab9154b83516569
MD5 6e494069f55de7049a5699dd72301b4b
SHA1 1b0b21207777bed6e187adfdf9d3b2d1db40e298
SHA512 1649ffa3e1d5f87323264849f9ffecd5c68df499ff9e6b0894a77b20ce92c689ee8a99cd07c5292bc26fb32783e137fa1977b792381786b6b45eb13ab5857e27
SSDEEP 98304:6BkLi3hdqYnPhrisRYrS806k+tPhAxw8qmVoaDwyqXyR2me7Pi2YazxTYB/y2kZZ:6BUimURi506phmVonCMPTzxMB/WVn
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

File Explorer

6e494069f55de7049a5699dd72301b4b.exe

.exe 5.5MB

6e494069f55de7049a5699dd72301b4b.exe

IMPHASH f540b6d6dcfc33b21d0deb0ccba24751
SHA256 49d4689b5641b161f0ab00aa490ea276fcab2128cb33d802fab9154b83516569
MD5 6e494069f55de7049a5699dd72301b4b
SHA1 1b0b21207777bed6e187adfdf9d3b2d1db40e298
SHA512 1649ffa3e1d5f87323264849f9ffecd5c68df499ff9e6b0894a77b20ce92c689ee8a99cd07c5292bc26fb32783e137fa1977b792381786b6b45eb13ab5857e27
SSDEEP 98304:6BkLi3hdqYnPhrisRYrS806k+tPhAxw8qmVoaDwyqXyR2me7Pi2YazxTYB/y2kZZ:6BUimURi506phmVonCMPTzxMB/WVn
MD5 SHA1 SHA512 SSDEEP

windows x86

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect

PE Signature issue

Digest

82:9c:5d:a1:1a:e8:82:b5:f2:f7:21:ea:12:9d:82:1d:93:c7:b3:02:b8:c2:76:13:39:13:6c:9f:91:a4:29:9d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Minor OS version

Major OS version

Entry point

6222454

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InitializeCriticalSectionEx lstrlenA lstrcatA GetModuleHandleA SetCurrentDirectoryA Sleep GetModuleHandleExA GetFileAttributesA GetBinaryTypeA QueryFullProcessImageNameA GetSystemDirectoryA GlobalAlloc lstrcpyA SetFileAttributesA VerSetConditionMask WideCharToMultiByte VerifyVersionInfoW GetSystemTimeAsFileTime HeapFree HeapAlloc GetProcAddress lstrcpynA GetProcessHeap AreFileApisANSI TryEnterCriticalSection HeapCreate EnterCriticalSection GetFullPathNameW GetDiskFreeSpaceW OutputDebugStringA LockFile LeaveCriticalSection InitializeCriticalSection GetFullPathNameA SetEndOfFile FindClose GetTempPathW CreateMutexW WaitForSingleObject GetFileAttributesW GetCurrentThreadId UnmapViewOfFile HeapValidate HeapSize MultiByteToWideChar GetTempPathA FormatMessageW GetDiskFreeSpaceA GetFileAttributesExW OutputDebugStringW FlushViewOfFile LoadLibraryA WaitForSingleObjectEx DeleteFileA DeleteFileW HeapReAlloc GetSystemInfo LoadLibraryW HeapCompact HeapDestroy UnlockFile LocalFree LockFileEx GetFileSize DeleteCriticalSection GetCurrentProcessId SystemTimeToFileTime FreeLibrary GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers WriteConsoleW CloseHandle CreateFileA GetLastError CreateFileW SetFilePointer WriteFile UnlockFileEx ReadFile SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent InitializeSListHead InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW GetModuleHandleW IsDebuggerPresent GetStartupInfoW CreateDirectoryW FindFirstFileExW FindNextFileW SetFilePointerEx GetFileInformationByHandleEx QueryPerformanceFrequency LCMapStringEx EncodePointer DecodePointer GetCPInfo GetStringTypeW SetLastError GetThreadTimes GetCurrentThread InterlockedPushEntrySList RaiseException RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetFileType ExitProcess GetModuleHandleExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleFileNameW GetStdHandle GetConsoleMode ReadConsoleW GetConsoleOutputCP SetStdHandle CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileSizeEx GetTimeZoneInformation IsValidCodePage VirtualQuery LocalAlloc LocalFree GetModuleFileNameW GetProcessAffinityMask SetProcessAffinityMask SetThreadAffinityMask Sleep ExitProcess FreeLibrary LoadLibraryA GetModuleHandleA GetProcAddress

user32

CharNextA GetProcessWindowStation GetUserObjectInformationW

advapi32

RegCloseKey RegCreateKeyExA RegSetValueExA OpenProcessToken RegOpenKeyExA GetTokenInformation CryptReleaseContext

shell32

ShellExecuteA

ole32

CoCreateInstance CoInitializeEx CoUninitialize

Name

.text

Size

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

168KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

5.0MB

Virtual Size

5.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

467KB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ