proxy hackvshack[.]net[.]rar

Sharing

Copy URL Twitter E-mail

General

Target

proxy hackvshack.net.rar
Size

5.8MB
MD5

8196eeb000ccdf1d6a483f83b80366d4
SHA1

835f4243bb9260dae89bb49b466851c3e6138af7
SHA256

e7bba2f14deff5fdf6bce503e13d9ace87901f03f387b20eade5ddcdc4eda56f
SHA512

b40de2c7584775ce9da8ddf00fb0fc8907841357b87aa9a62d09bbf886a1441aa5e83c4885a7022b412780d11e2068945e52c444f2e253f3bd34923a5b359e71
SSDEEP

98304:d29isJbpSjYXkKglNj+zhhZ8t1Juib0M8HPbsscOHKADB6XDlAPGslC2FLly38w:8YqbghlNj+Nj8zYibDQsfOHKaBQDG+se

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
static1/unpack001/proxy.dll	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/proxy.dll

Files

proxy hackvshack.net.rar
.rar
proxy.dll
.dll windows x86

1b6d5e5577534f2fcc281b461dbc89ae

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

comdlg32

GetOpenFileNameA

tier0

Warning

msvcp140

?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z

kernel32

GetLocaleInfoEx
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

vcruntime140

_except_handler4_common

api-ms-win-crt-runtime-l1-1-0

_initterm

api-ms-win-crt-stdio-l1-1-0

_close

api-ms-win-crt-heap-l1-1-0

calloc

api-ms-win-crt-utility-l1-1-0

srand

api-ms-win-crt-filesystem-l1-1-0

_unlock_file

api-ms-win-crt-string-l1-1-0

strncpy

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-math-l1-1-0

floor

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func

vstdlib

KeyValuesSystem

wtsapi32

WTSSendMessageW

user32

GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW

Exports

Exports

CreateInterface

Sections

.text
Size: - Virtual size: 921KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 380KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 395KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.msvcjmc
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 6.0MB - Virtual size: 6.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 469B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
proxy.vdf
readme.txt

Sharing

General

Malware Config

Signatures

Files

1b6d5e5577534f2fcc281b461dbc89ae

Headers

DLL Characteristics

File Characteristics

Imports

comdlg32

tier0

msvcp140

kernel32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

vstdlib

wtsapi32

user32

Exports

Exports

Sections

.text Size: - Virtual size: 921KB

.rdata Size: - Virtual size: 380KB

.data Size: - Virtual size: 395KB

.msvcjmc Size: - Virtual size: 1KB

.vmp0 Size: - Virtual size: 3.4MB

.vmp1 Size: 6.0MB - Virtual size: 6.0MB

.reloc Size: 1KB - Virtual size: 1KB

.rsrc Size: 512B - Virtual size: 469B

.text
Size: - Virtual size: 921KB

.rdata
Size: - Virtual size: 380KB

.data
Size: - Virtual size: 395KB

.msvcjmc
Size: - Virtual size: 1KB

.vmp0
Size: - Virtual size: 3.4MB

.vmp1
Size: 6.0MB - Virtual size: 6.0MB

.reloc
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 469B