7f426b327c878f799c74bb4b8a532cb3[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

7f426b327c878f799c74bb4b8a532cb3.bin
Size

5.1MB
MD5

e09242ba44698de2a28a7068e10a445a
SHA1

c2c60fe1664c0051518a8fa1e90e2145a03b4b0b
SHA256

37a4b5d6477f502526607ed93db888a9b798bab2cbbdad263adfa67c052865ba
SHA512

2d1cd25386abf2db4630bebea78a7898aee90f8826d771f266d5af4249e8d031b0f589b4cda66e8e27b04f7a8780c740ebad546f0d0068df9d11e29057f8c94b
SSDEEP

98304:f43pILQKqDPZNujkNRP9kntXYhT5M4q5eguzA1ZctX+TGXsTDRgPeb4Xsf89qQ2:fVoLZh/mntozM4q5egmA1ZctX+TGJPeF

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
static1/unpack001/71b24f92a597f6eaab7a64fd53008a8b29eab8c48e32d45caebcc56baf15fcdc.exe	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/71b24f92a597f6eaab7a64fd53008a8b29eab8c48e32d45caebcc56baf15fcdc.exe

Files

7f426b327c878f799c74bb4b8a532cb3.bin
.zip

Password: infected
71b24f92a597f6eaab7a64fd53008a8b29eab8c48e32d45caebcc56baf15fcdc.exe
.exe windows x64

Password: infected

1c4dfdba330f9207b50c6b2051ead1e6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

VirtualProtect
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

ShowWindow
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW

urlmon

URLDownloadToFileA

wtsapi32

WTSSendMessageW

Sections

.text
Size: - Virtual size: 394KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 129KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 5.4MB - Virtual size: 5.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 212B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

1c4dfdba330f9207b50c6b2051ead1e6

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

urlmon

wtsapi32

Sections

.text Size: - Virtual size: 394KB

.rdata Size: - Virtual size: 129KB

.data Size: - Virtual size: 12KB

.pdata Size: - Virtual size: 18KB

_RDATA Size: - Virtual size: 348B

.vmp0 Size: - Virtual size: 3.3MB

.vmp1 Size: 5.4MB - Virtual size: 5.4MB

.reloc Size: 512B - Virtual size: 212B

.rsrc Size: 5KB - Virtual size: 4KB

.text
Size: - Virtual size: 394KB

.rdata
Size: - Virtual size: 129KB

.data
Size: - Virtual size: 12KB

.pdata
Size: - Virtual size: 18KB

_RDATA
Size: - Virtual size: 348B

.vmp0
Size: - Virtual size: 3.3MB

.vmp1
Size: 5.4MB - Virtual size: 5.4MB

.reloc
Size: 512B - Virtual size: 212B

.rsrc
Size: 5KB - Virtual size: 4KB