SecuriteInfo[.]com[.]Trojan[.]Generic[.]8710286[.]11605[.]21205[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

SecuriteInfo.com.Trojan.Generic.8710286.11605.21205.dll
Size

1.4MB
MD5

54c43b68c08945cc84c7c859685d12a6
SHA1

811a19d339bf29d7b4d43b0ba3921f7288739aec
SHA256

3877d44471fa751f84da84d7ce2d1cd7c802c881e0bddc9227dd1b78c8176525
SHA512

705a85ecd47a7376bdb176976b082739d59ba4a2c142ba0e6b9ded356733712ede4f07b884346b44fc785efae264263a51749b684e426ce9c3887e71a939c3c9
SSDEEP

12288:AWTejoJJMXnNRuPg3wRBUZQxqpq30ChwDbonPltVwXU3GAIq2eE:XSsAnrcHRcQa11bUO0IqU

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SecuriteInfo.com.Trojan.Generic.8710286.11605.21205.dll

Files

SecuriteInfo.com.Trojan.Generic.8710286.11605.21205.dll
.dll regsvr32 windows:5 windows x86

a6d5186954e13954826e6d368eb82cdd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

WSAGetLastError

xlluaruntime

lua_toboolean

kernel32

PostQueuedCompletionStatus
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

GetWindowLongW
MessageBoxA

ole32

CoCreateInstance

oleaut32

VarBstrCmp

atl90

ord15

msvcp90

?find_first_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z

msvcr90

??1exception@std@@UAE@XZ

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
XLUserS_CreateXunleiUserInstance

Sections

.text
Size: - Virtual size: 176KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: - Virtual size: 426KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE

.vmp2
Size: 537KB - Virtual size: 536KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 228B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a6d5186954e13954826e6d368eb82cdd

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

xlluaruntime

kernel32

user32

ole32

oleaut32

atl90

msvcp90

msvcr90

Exports

Exports

Sections

.text Size: - Virtual size: 176KB

.rdata Size: - Virtual size: 45KB

.data Size: - Virtual size: 8KB

.rsrc Size: 17KB - Virtual size: 16KB

.vmp0 Size: - Virtual size: 19KB

.vmp1 Size: - Virtual size: 426KB

.vmp2 Size: 537KB - Virtual size: 536KB

.reloc Size: 512B - Virtual size: 228B

.text
Size: - Virtual size: 176KB

.rdata
Size: - Virtual size: 45KB

.data
Size: - Virtual size: 8KB

.rsrc
Size: 17KB - Virtual size: 16KB

.vmp0
Size: - Virtual size: 19KB

.vmp1
Size: - Virtual size: 426KB

.vmp2
Size: 537KB - Virtual size: 536KB

.reloc
Size: 512B - Virtual size: 228B