e89c4ac328f60c40dcf9704ee5b2e7bf_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e89c4ac328f60c40dcf9704ee5b2e7bf_JC.exe
Size

736KB
MD5

e89c4ac328f60c40dcf9704ee5b2e7bf
SHA1

b68d7c358ddfa20b6ae06c2759fb46b766fc67c6
SHA256

a43a5a54f329d679b0f26af6e04e82899eefca7a620b72cb323e40b0ec9c93ba
SHA512

97f81e3d47064edd9fc423596304c2b7a411bda866447e28732428a516c55266dc7acc1fc39c2f799b9394bfa4b667788b2b0868e04fa0464cf586b3c5a203b4
SSDEEP

12288:lFDVGSMJwtGU2TsG4SRGMEl0hdEsFh7VmAfaP+/fup7Rc4Uh/83T2J/B5VA9d:l3GSKZJ4SR3E6hdrFh7AU6ym4w2J/B58

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e89c4ac328f60c40dcf9704ee5b2e7bf_JC.exe

Files

e89c4ac328f60c40dcf9704ee5b2e7bf_JC.exe
.exe windows:4 windows x86

e149f664ce561df2dbb8112bd0e3c9b7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrlenA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess

user32

PeekMessageA
MessageBoxA

advapi32

LookupPrivilegeValueA

shell32

CommandLineToArgvW

iphlpapi

CreateIpForwardEntry

wtsapi32

WTSQueryUserToken

userenv

CreateEnvironmentBlock

ws2_32

WSAStartup

Sections

.text
Size: - Virtual size: 115KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 716KB - Virtual size: 713KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ