7f426b327c878f799c74bb4b8a532cb3[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

7f426b327c878f799c74bb4b8a532cb3.exe
Size

5.4MB
MD5

7f426b327c878f799c74bb4b8a532cb3
SHA1

0315cc83c6d781db16e7e34d7efc5e2fb4db4829
SHA256

71b24f92a597f6eaab7a64fd53008a8b29eab8c48e32d45caebcc56baf15fcdc
SHA512

635d7ee4392c18996da1becb2d279e27563acc78fd015bc7dc2d6d2b9fb9b116656038db7aa37ef954c54b38e439c676ad5432ba277720743649aa2b6cb38c05
SSDEEP

98304:683d1dL0L1ClJNCsIPi+sSS/DU5+WWsO77LENBn0fVIXp/+:91dL0L1ClKdivSUUgWWHLENJSGt+

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7f426b327c878f799c74bb4b8a532cb3.exe

Files

7f426b327c878f799c74bb4b8a532cb3.exe
.exe windows x64

1c4dfdba330f9207b50c6b2051ead1e6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

VirtualProtect
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

ShowWindow
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW

urlmon

URLDownloadToFileA

wtsapi32

WTSSendMessageW

Sections

.text
Size: - Virtual size: 394KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 129KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 5.4MB - Virtual size: 5.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 212B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1c4dfdba330f9207b50c6b2051ead1e6

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

urlmon

wtsapi32

Sections

.text Size: - Virtual size: 394KB

.rdata Size: - Virtual size: 129KB

.data Size: - Virtual size: 12KB

.pdata Size: - Virtual size: 18KB

_RDATA Size: - Virtual size: 348B

.vmp0 Size: - Virtual size: 3.3MB

.vmp1 Size: 5.4MB - Virtual size: 5.4MB

.reloc Size: 512B - Virtual size: 212B

.rsrc Size: 5KB - Virtual size: 4KB

.text
Size: - Virtual size: 394KB

.rdata
Size: - Virtual size: 129KB

.data
Size: - Virtual size: 12KB

.pdata
Size: - Virtual size: 18KB

_RDATA
Size: - Virtual size: 348B

.vmp0
Size: - Virtual size: 3.3MB

.vmp1
Size: 5.4MB - Virtual size: 5.4MB

.reloc
Size: 512B - Virtual size: 212B

.rsrc
Size: 5KB - Virtual size: 4KB