5a7a9ea0a0c92878491f2a15eb8b9086b2a00049740e141aca16a0cd19626fe9

Sharing

Copy URL Twitter E-mail

General

Target

5a7a9ea0a0c92878491f2a15eb8b9086b2a00049740e141aca16a0cd19626fe9
Size

5.2MB
MD5

05509cf4ce63ed7ac441679518a9fe88
SHA1

d08dc3102e060455ba388d4cc78cd569e4ee7695
SHA256

5a7a9ea0a0c92878491f2a15eb8b9086b2a00049740e141aca16a0cd19626fe9
SHA512

f4cd22e8025fb6bd4d3775c84b71317274b9c29d89d090ddbd8e91a0be69099832fe25ac2c51bf090a6b8d9a6ff6c2c3ab74fab3ad14ea00dae305a3d2f097fa
SSDEEP

98304:mLhxEuh3MzciXH26MOG9813fpkpW1UDHu0KATnC21:mLvEQ8zciXsAfpkGuHJv

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5a7a9ea0a0c92878491f2a15eb8b9086b2a00049740e141aca16a0cd19626fe9

Files

5a7a9ea0a0c92878491f2a15eb8b9086b2a00049740e141aca16a0cd19626fe9
.dll windows:6 windows x86

f677dce0f05763d90ce1d876c18b8275

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mrtcomm

?HardwareResetByFirmware@CDiskFirmware@@UAE?AW4CmdStatus@CIdeAta@@H@Z
?OpenEx@CSerialPort@@UAEHPB_WKKKKKKH@Z
?ClsWorkThreadProc@CSerialPort@@MAEIXZ
?OnCompletion@CSerialPort@@UAEXKKPAU_OVERLAPPED@@@Z
?ClearReadBuffer@CSerialPort@@UAEXXZ
?Close@CSerialPort@@UAEXXZ
??1CSerialPort@@UAE@XZ
?ClsWorkThreadProc@CSerialPortPro@@MAEIXZ
?ClearReadBuffer@CSerialPortPro@@UAEXXZ
??1CDiskFirmware@@UAE@XZ
?CancelReadDeviceByFirmware@CDiskFirmware@@UAEXXZ
?HeadMapEnter@CDiskFirmware@@UAEHXZ
?CreateHeadMap@CDiskFirmware@@UAEHPAVKernelFileMapping@@_K1P6AHPAX1@Z2AAE@Z
?SoftResetByFirmware@CDiskFirmware@@UAE?AW4CmdStatus@CIdeAta@@H@Z
?ReadPort@CSerialPort@@UAEKPAEK@Z
?SetPowerStatusByFirmware@CDiskFirmware@@UAE?AW4CmdStatus@CIdeAta@@EH@Z
??1CSerialPortPro@@UAE@XZ
?OpenEx@CSerialPortPro@@UAEHPB_WKKKKKKH@Z
?Close@CSerialPortPro@@UAEXXZ
?ReadPort@CSerialPortPro@@UAEKPAEK@Z

mrtdatabase

??1CDbFile@@UAE@XZ
??1CDataBaseManager@@UAE@XZ
?Write@CDbEncryptFile@@UAEHPAEKH@Z
?Read@CDbEncryptFile@@UAEHPAEKH@Z
??1CDbEncryptFile@@UAE@XZ
?Read@CDbFile@@UAEHPAEKH@Z
?OpenSourceDb@CDataBaseManager@@QAEHHH@Z
??0CDataBaseManager@@QAE@PAVCDriverManager@@PB_W@Z
??0CDbManagerPage@@QAE@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PAVCDataBaseManager@@PB_WPAUtagMSG@@H@Z
?GetThisClass@CDbManagerPage@@SGPAUCRuntimeClass@@XZ
?GetThisClass@CDbExplorerPage@@SGPAUCRuntimeClass@@XZ
?Write@CDbFile@@UAEHPAEKH@Z

mrtmange

??0CMrtDocTemplate@@QAE@PAUHINSTANCE__@@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PAUDocTemplateExtInfo@0@IPAUCRuntimeClass@@33@Z
??1CMrtBaseDocument@@UAE@XZ
?GetThisClass@CMrtBaseDocument@@SGPAUCRuntimeClass@@XZ
??0CMrtBaseDocument@@QAE@XZ
?OnNewDocument@CMrtBaseDocument@@UAEHXZ
?SetMrtInterface@CMrtBaseDocument@@UAEXKPAX@Z
?SwitchMrtInterface@CMrtBaseDocument@@UAEXK@Z
?AppendDataToWindow@CMrtBaseDocument@@UAEXPAUHWND__@@@Z

mfc140u

kernel32

Sleep
OutputDebugStringW
GetLastError
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
CloseHandle
GetModuleHandleW
GetProcAddress
DeviceIoControl
QueryPerformanceCounter
GetTickCount
GetCurrentProcess
InitializeCriticalSectionEx
ExitProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
CreateEventW
IsDebuggerPresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

PostMessageW
SendMessageW
EnableWindow
GetProcessWindowStation
GetUserObjectInformationW

shell32

ShellExecuteW

msvcp140

?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z

vcruntime140

__std_terminate
_purecall
memset
__CxxFrameHandler3
__vcrt_InitializeCriticalSectionEx
_except_handler4_common
__std_type_info_destroy_list
memcpy
_CxxThrowException

api-ms-win-crt-heap-l1-1-0

free

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
terminate

api-ms-win-crt-math-l1-1-0

_except1
_libm_sse2_sin_precise

Exports

Exports

??0CDataBaseManager@@QAE@ABV0@@Z
??0CDataCenter@@QAE@ABV0@@Z
??0CDataStore@@QAE@ABV0@@Z
??0CDbEncryptFile@@QAE@ABV0@@Z
??0CDbFile@@QAE@ABV0@@Z
??0CDiskFirmware@@QAE@ABV0@@Z
??0CSerialPort@@QAE@ABV0@@Z
??0CSerialPortPro@@QAE@ABV0@@Z
??1CSerialException@@UAE@XZ
??4CDataBaseManager@@QAEAAV0@ABV0@@Z
??4CDataCenter@@QAEAAV0@ABV0@@Z
??4CDataStore@@QAEAAV0@ABV0@@Z
??4CDbEncryptFile@@QAEAAV0@ABV0@@Z
??4CDbFile@@QAEAAV0@ABV0@@Z
??4CDiskFirmware@@QAEAAV0@ABV0@@Z
??4CSerialPort@@QAEAAV0@ABV0@@Z
??4CSerialPortPro@@QAEAAV0@ABV0@@Z
??BCSerialPort@@QBEPAXXZ
??_7CDataBaseManager@@6B@
??_7CDbEncryptFile@@6B@
??_7CDbFile@@6B@
??_7CDiskFirmware@@6B@
??_7CSerialPort@@6B@
??_7CSerialPortPro@@6B@
?IsOpen@CSerialPort@@QBEHXZ
?WM_UM_SEARCHDATACOMPELE@CDbExplorerPage@@2IB
?WM_UM_WRITECHAR@CSerialPort@@1IB
MrtCommonSystem

Sections

.text
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.l1
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f677dce0f05763d90ce1d876c18b8275

Headers

DLL Characteristics

File Characteristics

Imports

mrtcomm

mrtdatabase

mrtmange

mfc140u

kernel32

user32

shell32

msvcp140

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

Exports

Exports

Sections

.text Size: 32KB - Virtual size: 32KB

.rdata Size: 20KB - Virtual size: 20KB

.data Size: 4KB - Virtual size: 4KB

.gfids Size: 4KB - Virtual size: 4KB

.tls Size: 4KB - Virtual size: 4KB

.vmp0 Size: 1.7MB - Virtual size: 1.7MB

.vmp1 Size: 3.4MB - Virtual size: 3.4MB

.reloc Size: 4KB - Virtual size: 4KB

.rsrc Size: 2KB - Virtual size: 2KB

.l1 Size: 13KB - Virtual size: 13KB

.text
Size: 32KB - Virtual size: 32KB

.rdata
Size: 20KB - Virtual size: 20KB

.data
Size: 4KB - Virtual size: 4KB

.gfids
Size: 4KB - Virtual size: 4KB

.tls
Size: 4KB - Virtual size: 4KB

.vmp0
Size: 1.7MB - Virtual size: 1.7MB

.vmp1
Size: 3.4MB - Virtual size: 3.4MB

.reloc
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 2KB - Virtual size: 2KB

.l1
Size: 13KB - Virtual size: 13KB