e1f0253a23125b5bf1a4bac890ac4ddf[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

e1f0253a23125b5bf1a4bac890ac4ddf.exe
Size

6.6MB
MD5

e1f0253a23125b5bf1a4bac890ac4ddf
SHA1

80efca30c866d7c6d55141ea714d73533c92878c
SHA256

c82ae04b929c0ce3df439d0b8e258703fccadfeeabd355706f8601104b52eec4
SHA512

f4c0b0f3f8868d2ef5c3d4e22ab971c654913a5b44bb784d6a4b05a9562905b9dc9d51811a93c9d1b9a25cc64d508a0b55c8dc26398a1b9dab7ed1a1dd87c911
SSDEEP

98304:mC0+v0HZRqvQatWSCG1EodfTRWAD7XPTl9H17aa2/96qtm6E2X2p8jzXPL42:mvIgDlSPC0rXDpaa2/hm6X2pCPP

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

e1f0253a23125b5bf1a4bac890ac4ddf.exe
.exe windows x86

ecb125da1bbce59b61a3dc18c66efab2

Code Sign

24:c8:47:7e:dd:13:46:a1:4a:8e:39:13:06:76:18:3f
Certificate

Issuer

CN=Nokia 110 4G DS (2021) Turquoise

Not Before

22-06-2023 13:04

Not After

23-06-2033 13:04

Subject

CN=Nokia 110 4G DS (2021) Turquoise

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-05-2023 00:00

Not After

02-08-2034 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e5:22:f3:6a:20:2c:91:44:d1:06:95:3a:9e:11:8a:07:d8:d1:1c:11:3f:52:fe:9c:62:22:cc:84:67:5a:68:65
Signer

Actual PE Digest

e5:22:f3:6a:20:2c:91:44:d1:06:95:3a:9e:11:8a:07:d8:d1:1c:11:3f:52:fe:9c:62:22:cc:84:67:5a:68:65

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersionExW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

advapi32

RegCloseKey

shell32

ShellExecuteA

wininet

HttpOpenRequestA

user32

CharUpperBuffW

Sections

.text
Size: - Virtual size: 218KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 3.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp2
Size: 6.4MB - Virtual size: 6.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 159KB - Virtual size: 159KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ecb125da1bbce59b61a3dc18c66efab2

Code Sign

24:c8:47:7e:dd:13:46:a1:4a:8e:39:13:06:76:18:3fCertificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

e5:22:f3:6a:20:2c:91:44:d1:06:95:3a:9e:11:8a:07:d8:d1:1c:11:3f:52:fe:9c:62:22:cc:84:67:5a:68:65Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

shell32

wininet

user32

Sections

.text Size: - Virtual size: 218KB

.rdata Size: - Virtual size: 63KB

.data Size: - Virtual size: 10KB

.vmp0 Size: - Virtual size: 3.5MB

.vmp1 Size: 1KB - Virtual size: 1KB

.vmp2 Size: 6.4MB - Virtual size: 6.4MB

.reloc Size: 2KB - Virtual size: 1KB

.rsrc Size: 159KB - Virtual size: 159KB

24:c8:47:7e:dd:13:46:a1:4a:8e:39:13:06:76:18:3f
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

e5:22:f3:6a:20:2c:91:44:d1:06:95:3a:9e:11:8a:07:d8:d1:1c:11:3f:52:fe:9c:62:22:cc:84:67:5a:68:65
Signer

.text
Size: - Virtual size: 218KB

.rdata
Size: - Virtual size: 63KB

.data
Size: - Virtual size: 10KB

.vmp0
Size: - Virtual size: 3.5MB

.vmp1
Size: 1KB - Virtual size: 1KB

.vmp2
Size: 6.4MB - Virtual size: 6.4MB

.reloc
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 159KB - Virtual size: 159KB