607fde2646a8f9187f21787bf00e607f888d804c98a2d76f38f5b6228f878122[.]exe[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

607fde2646a8f9187f21787bf00e607f888d804c98a2d76f38f5b6228f878122.exe.zip
Size

2.8MB
MD5

0685489f574711801b93ff0fb24f363a
SHA1

7fa733d0dba100d40068b721ba15e775eafb4e71
SHA256

c6c84b89747f4c0c470449e12e22c1d0466abc537f5b9c3c59653f3bec996584
SHA512

3282efbc9be299c26a0793ef1fc79bcc16aaa557bf3f6c4004feb01942f60700431211204d07b9731484ce03506a2866bcefb543231c68ed71b7f11a33ab7f9c
SSDEEP

49152:VKU34t3zEsdK7qo13YhG5ArzpnAYl/Hi+mDKUQGia1PBV8cG:QU34tjEK6q2Ihm82rnDAGiaBjG

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
static1/unpack001/607fde2646a8f9187f21787bf00e607f888d804c98a2d76f38f5b6228f878122.exe	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/607fde2646a8f9187f21787bf00e607f888d804c98a2d76f38f5b6228f878122.exe

Files

607fde2646a8f9187f21787bf00e607f888d804c98a2d76f38f5b6228f878122.exe.zip
.zip

Password: infected
607fde2646a8f9187f21787bf00e607f888d804c98a2d76f38f5b6228f878122.exe
.exe windows:5 windows x86

aca4a209ac068f95d778d53b7dc20419

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

vhookjx2

?InjectDll@@YAHPAUHWND__@@@Z

kernel32

GetVersionExW
DeleteFileW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

SetRect

gdi32

CreateBitmap

msimg32

AlphaBlend

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW

advapi32

RegEnumKeyW

shell32

SHGetDesktopFolder

comctl32

InitCommonControlsEx

shlwapi

PathFindFileNameW

ole32

CoInitialize

oleaut32

OleCreateFontIndirect

oledlg

OleUIBusyW

gdiplus

GdipDrawImageRectI

ws2_32

WSAStartup

oleacc

AccessibleObjectFromWindow

imm32

ImmGetContext

winmm

PlaySoundW

Sections

.text
Size: - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 291KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 224B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

aca4a209ac068f95d778d53b7dc20419

Headers

DLL Characteristics

File Characteristics

Imports

vhookjx2

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

oledlg

gdiplus

ws2_32

oleacc

imm32

winmm

Sections

.text Size: - Virtual size: 1.2MB

.rdata Size: - Virtual size: 291KB

.data Size: - Virtual size: 55KB

.vmp0 Size: - Virtual size: 2.1MB

.vmp1 Size: 2.9MB - Virtual size: 2.9MB

.reloc Size: 512B - Virtual size: 224B

.rsrc Size: 13KB - Virtual size: 12KB

.text
Size: - Virtual size: 1.2MB

.rdata
Size: - Virtual size: 291KB

.data
Size: - Virtual size: 55KB

.vmp0
Size: - Virtual size: 2.1MB

.vmp1
Size: 2.9MB - Virtual size: 2.9MB

.reloc
Size: 512B - Virtual size: 224B

.rsrc
Size: 13KB - Virtual size: 12KB