f9fd02eba74c225650ea8388bfdf61140d53421b71865ab2ab51a842205707be

Sharing

Copy URL Twitter E-mail

General

Target

f9fd02eba74c225650ea8388bfdf61140d53421b71865ab2ab51a842205707be
Size

5.6MB
MD5

17b976a4916285830a4a03246f744ddf
SHA1

f1d3c5906699572e2edb1c76f7754c9d62c806cd
SHA256

f9fd02eba74c225650ea8388bfdf61140d53421b71865ab2ab51a842205707be
SHA512

e7e006d3019d2ca16b9b4c9a1eaf3b21351068ae0085a83bb04c4b013f32b6e78a71edc47462635dc42399a7051217f479454bd740c895a20896ca0d5486c8fc
SSDEEP

98304:mLswHwGTA20KVTXTuLNYAjM6g48sRjE9jr8xJTHZ7GMe2f:Q5FVjiLC6osRgoVhD

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f9fd02eba74c225650ea8388bfdf61140d53421b71865ab2ab51a842205707be

Files

f9fd02eba74c225650ea8388bfdf61140d53421b71865ab2ab51a842205707be
.dll windows:6 windows x86

9a94613c168046344f2f9d6af18d0885

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mrtcomm

??1CSerialPort@@UAE@XZ
??1CDiskFirmware@@UAE@XZ
?Close@CSerialPort@@UAEXXZ
?ClearReadBuffer@CSerialPort@@UAEXXZ
?OnCompletion@CSerialPort@@UAEXKKPAU_OVERLAPPED@@@Z
?ClsWorkThreadProc@CSerialPort@@MAEIXZ
?OpenEx@CSerialPort@@UAEHPB_WKKKKKKH@Z
?ReadPort@CSerialPort@@UAEKPAEK@Z
?Close@CSerialPortPro@@UAEXXZ
?ClearReadBuffer@CSerialPortPro@@UAEXXZ
?ClsWorkThreadProc@CSerialPortPro@@MAEIXZ
?OpenEx@CSerialPortPro@@UAEHPB_WKKKKKKH@Z
?ReadPort@CSerialPortPro@@UAEKPAEK@Z
?CancelReadDeviceByFirmware@CDiskFirmware@@UAEXXZ
?HeadMapEnter@CDiskFirmware@@UAEHXZ
?CreateHeadMap@CDiskFirmware@@UAEHPAVKernelFileMapping@@_K1P6AHPAX1@Z2AAE@Z
?SoftResetByFirmware@CDiskFirmware@@UAE?AW4CmdStatus@CIdeAta@@H@Z
?HardwareResetByFirmware@CDiskFirmware@@UAE?AW4CmdStatus@CIdeAta@@H@Z
?SetPowerStatusByFirmware@CDiskFirmware@@UAE?AW4CmdStatus@CIdeAta@@EH@Z
??0CDataCenter@@QAE@XZ
??1CDataCenter@@QAE@XZ
?SetBasePath@CDataCenter@@QAEXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?SetUserLong@CDataCenter@@QAEHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@J@Z
?MakeDirectoryEx@CLitCall@@SAHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?EnumSerialPorts@CLitCall@@SAXAAV?$CArray@USSerInfo@CLitCall@@AAU12@@@H@Z
?GetUserLong@CDataCenter@@QAEJV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?SetTimeouts@CSerialPort@@QAEXAAU_COMMTIMEOUTS@@@Z
?SetUserString@CDataCenter@@QAEHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@0@Z
?GetUserString@CDataCenter@@QAE?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V23@@Z
?GetAppPath@CLitCall@@SA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?UIAddLogs@CDiskFirmware@@QAEXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@H@Z
?UIAddLogCheck@CDiskFirmware@@QAEXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@0H@Z
??0CDiskFirmware@@QAE@PAVCDiskDevice@@@Z
?UISetProgress@CDiskFirmware@@QAEXH@Z
?GetState@CSerialPort@@QAEXAAU_DCB@@@Z
?DiskScanTask@CDiskFirmware@@SAHPAV1@PAUStrScanTaskParam@1@@Z
?ReadDiskByATA@CDiskFirmware@@SAKPAV1@PAUSReadWriteDiskPram@1@@Z
?WriteDiskByATA@CDiskFirmware@@SAKPAV1@PAUSReadWriteDiskPram@1@@Z
?SetFlowControl@CSerialPort@@QAEXKAAU_DCB@@@Z
?SetState@CSerialPort@@QAEXAAU_DCB@@@Z
??1CSerialPortPro@@UAE@XZ

mrtdatabase

?Read@CDbFile@@UAEHPAEKH@Z
??1CDataBaseManager@@UAE@XZ
??1CDbEncryptFile@@UAE@XZ
??1CDbFile@@UAE@XZ
??0CDataBaseManager@@QAE@PAVCDriverManager@@PB_W@Z
?Write@CDbFile@@UAEHPAEKH@Z
?Read@CDbEncryptFile@@UAEHPAEKH@Z
?Write@CDbEncryptFile@@UAEHPAEKH@Z
??1CDbPathDlg@@UAE@XZ
?OpenSourceDb@CDataBaseManager@@QAEHHH@Z
??0CDbManagerPage@@QAE@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PAVCDataBaseManager@@PB_WPAUtagMSG@@H@Z
?CreateFolder@CDataBaseManager@@QAEHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
??0CDbPathDlg@@QAE@PAVCDataBaseManager@@PB_WHPAVCWnd@@@Z
?EnumFileInFolder@CDataBaseManager@@QAEHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@AAV?$CArray@UDBFileInfo@@AAU1@@@@Z
??0CDbFile@@QAE@PAVCDataBaseManager@@@Z
?GetFilelength@CDbFile@@QAEKXZ
?Open@CDbFile@@QAEHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@HPB_WH@Z

mrtmange

??0CMrtDocTemplate@@QAE@PAUHINSTANCE__@@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PAUDocTemplateExtInfo@0@IPAUCRuntimeClass@@33@Z
?GetThisClass@CMrtBaseDocument@@SGPAUCRuntimeClass@@XZ
??0CMrtBaseDocument@@QAE@XZ
?OnNewDocument@CMrtBaseDocument@@UAEHXZ
?SetMrtInterface@CMrtBaseDocument@@UAEXKPAX@Z
?SwitchMrtInterface@CMrtBaseDocument@@UAEXK@Z
?AppendDataToWindow@CMrtBaseDocument@@UAEXPAUHWND__@@@Z
??1CMrtBaseDocument@@UAE@XZ

mrtuibal

??0CPathDlg@@QAE@XZ
??1CPathDlg@@QAE@XZ
?OpenDlg@CPathDlg@@QAE?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PAUHWND__@@PB_W@Z
??1CReportCtrl@@UAE@XZ
??0CReportCtrl@@QAE@XZ
?SetGridLines@CReportCtrl@@QAEXH@Z
?SetExtendedStyle@CReportCtrl@@QAEKK@Z
?SetColumnHeader@CReportCtrl@@QAEHABV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?SetItemText@CReportCtrl@@QAEHHHPB_W@Z
?InsertItem@CReportCtrl@@QAEHHPB_W@Z
?GetItemCount@CReportCtrl@@QBEHK@Z
?SetCheck@CReportCtrl@@QAEHHH@Z
?DeleteAllItems@CReportCtrl@@QAEHK@Z
??1CToolBarEx@@UAE@XZ
??1CRichEditCtrlGS@@UAE@XZ
??0CToolBarEx@@QAE@XZ
??0CRichEditCtrlGS@@QAE@XZ
?LoadToolBarEx@CToolBarEx@@QAEHIPAUHINSTANCE__@@HIII@Z
?SetColour@CRichEditCtrlGS@@QAEXK@Z
?WriteRTF@CRichEditCtrlGS@@QAEXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@_N@Z
?SetButton@CToolBarEx@@QAEXHH@Z
??1CHexEditBase@@UAE@XZ
??0CHexEditBase@@QAE@XZ
?SetShowColumnNum@CHexEditBase@@QAEX_N0@Z
?SetShowAddress@CHexEditBase@@QAEX_N0@Z
?SetShowAscii@CHexEditBase@@QAEX_N0@Z
?SetData@CHexEditBase@@QAEXPBEI_N1@Z
?OpenFile@CHexEditBase@@QAEHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?SaveToFile@CHexEditBase@@QAEIV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@II@Z
?AddOneColumns@CHexEditBase@@QAEXXZ
?DecOneColumns@CHexEditBase@@QAEXXZ
?OnEditFind@CHexEditBase@@QAEXXZ
?OnEditFindNext@CHexEditBase@@QAEXXZ
?OnGoto@CHexEditBase@@QAEXXZ
?OnEditCopy@CHexEditBase@@QAEXXZ
?OnEditPaste@CHexEditBase@@QAEXXZ
?GetData@CHexEditBase@@QAEIPAEI@Z
?OnEditFill@CHexEditBase@@QAEXXZ
?SetImageList@CReportCtrl@@QAEPAVCImageList@@PAV2@@Z
?SetEditable@CReportCtrl@@QAEXH@Z
??1CScanRectWnd@@UAE@XZ
??1CUIBalScanDlg@@UAE@XZ
??1CScanGrapWnd@@UAE@XZ
??0CScanRectWnd@@QAE@XZ
??0CScanGrapWnd@@QAE@XZ
?Init@CScanRectWnd@@QAEXXZ
?Clear@CScanMapData@@QAEXXZ
?AddData@CScanMapData@@QAEX_KK@Z
?SetBytesPerRow@CHexEditBase@@QAEXI_N0@Z
?SetDataNewSize@CHexEditBase@@QAEHKE@Z
??0CUIBalScanDlg@@QAE@PAVCWnd@@@Z

mfc140u

kernel32

UnhandledExceptionFilter
GetLastError
DeleteCriticalSection
ExitProcess
InitializeCriticalSectionEx
GetModuleFileNameW
EnterCriticalSection
OutputDebugStringW
LeaveCriticalSection
GetTickCount
QueryPerformanceCounter
DeviceIoControl
GetProcAddress
CloseHandle
GetModuleHandleW
TerminateProcess
IsProcessorFeaturePresent
CreateEventW
IsDebuggerPresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
ResumeThread
SuspendThread
WaitForSingleObject
TerminateThread
GetCurrentProcess
SetUnhandledExceptionFilter
Sleep
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

GetClientRect
KillTimer
SetTimer
SetWindowTextW
GetWindowRect
GetSubMenu
GetCursorPos
LoadMenuW
SendMessageW
EnableWindow
GetParent
LoadIconW
InvalidateRect
PostMessageW
wsprintfW
GetProcessWindowStation
GetUserObjectInformationW

gdi32

GetStockObject
GetObjectW
CreateFontW

shell32

ShellExecuteW
SHGetFileInfoW
DragFinish
DragQueryFileW
DragAcceptFiles

comctl32

ImageList_ReplaceIcon

shlwapi

PathIsDirectoryW

oleaut32

msvcp140

?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z

vcruntime140

_purecall
memset
__CxxFrameHandler3
__vcrt_InitializeCriticalSectionEx
_except_handler4_common
__std_type_info_destroy_list
memcpy
_CxxThrowException
__std_terminate

api-ms-win-crt-heap-l1-1-0

free

api-ms-win-crt-convert-l1-1-0

wcstoul
_wcstoui64
wcstol

api-ms-win-crt-time-l1-1-0

_localtime64_s
_time64
wcsftime

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
terminate
_invalid_parameter_noinfo
_errno

api-ms-win-crt-math-l1-1-0

_except1
_libm_sse2_sin_precise

Exports

Exports

??0CDataBaseManager@@QAE@ABV0@@Z
??0CDataCenter@@QAE@ABV0@@Z
??0CDataStore@@QAE@ABV0@@Z
??0CDbEncryptFile@@QAE@ABV0@@Z
??0CDbFile@@QAE@ABV0@@Z
??0CDiskFirmware@@QAE@ABV0@@Z
??0CPathDlg@@QAE@ABV0@@Z
??0CSerialPort@@QAE@ABV0@@Z
??0CSerialPortPro@@QAE@ABV0@@Z
??1CSerialException@@UAE@XZ
??4CDataBaseManager@@QAEAAV0@ABV0@@Z
??4CDataCenter@@QAEAAV0@ABV0@@Z
??4CDataStore@@QAEAAV0@ABV0@@Z
??4CDbEncryptFile@@QAEAAV0@ABV0@@Z
??4CDbFile@@QAEAAV0@ABV0@@Z
??4CDiskFirmware@@QAEAAV0@ABV0@@Z
??4CLitCall@@QAEAAV0@ABV0@@Z
??4CPathDlg@@QAEAAV0@ABV0@@Z
??4CSerialPort@@QAEAAV0@ABV0@@Z
??4CSerialPortPro@@QAEAAV0@ABV0@@Z
??BCSerialPort@@QBEPAXXZ
??_7CDataBaseManager@@6B@
??_7CDbEncryptFile@@6B@
??_7CDbFile@@6B@
??_7CDiskFirmware@@6B@
??_7CSerialPort@@6B@
??_7CSerialPortPro@@6B@
??_FCUIBalScanDlg@@QAEXXZ
?GetBytesPerRow@CHexEditBase@@QAEIXZ
?GetDataBuffer@CHexEditBase@@QBEPAEXZ
?GetDataSize@CHexEditBase@@QBEIXZ
?IsModified@CHexEditBase@@QBEHXZ
?IsOpen@CSerialPort@@QBEHXZ
?OnExtendContextMenu@CHexEditBase@@UAEXAAVCMenu@@@Z
?SetContextCopyStr@CHexEditBase@@QAEXABV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?SetContextPasteStr@CHexEditBase@@QAEXABV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?SetModifiedFlag@CHexEditBase@@QAEXH@Z
?WM_UM_SEARCHDATACOMPELE@CDbExplorerPage@@2IB
?WM_UM_WRITECHAR@CSerialPort@@1IB
MrtCommonSystem

Sections

.text
Size: 120KB - Virtual size: 120KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 3.6MB - Virtual size: 3.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.l1
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

9a94613c168046344f2f9d6af18d0885

Headers

DLL Characteristics

File Characteristics

Imports

mrtcomm

mrtdatabase

mrtmange

mrtuibal

mfc140u

kernel32

user32

gdi32

shell32

comctl32

shlwapi

oleaut32

msvcp140

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

Exports

Exports

Sections

.text Size: 120KB - Virtual size: 120KB

.rdata Size: 68KB - Virtual size: 68KB

.data Size: 4KB - Virtual size: 4KB

.gfids Size: 4KB - Virtual size: 4KB

.tls Size: 4KB - Virtual size: 4KB

.vmp0 Size: 1.8MB - Virtual size: 1.8MB

.vmp1 Size: 3.6MB - Virtual size: 3.6MB

.reloc Size: 4KB - Virtual size: 4KB

.rsrc Size: 10KB - Virtual size: 10KB

.l1 Size: 24KB - Virtual size: 24KB

.text
Size: 120KB - Virtual size: 120KB

.rdata
Size: 68KB - Virtual size: 68KB

.data
Size: 4KB - Virtual size: 4KB

.gfids
Size: 4KB - Virtual size: 4KB

.tls
Size: 4KB - Virtual size: 4KB

.vmp0
Size: 1.8MB - Virtual size: 1.8MB

.vmp1
Size: 3.6MB - Virtual size: 3.6MB

.reloc
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 10KB - Virtual size: 10KB

.l1
Size: 24KB - Virtual size: 24KB