e6a264207d71c60c1c77c49dcd8366877ee0de0a81c35a5ac8bb14c043500fe5

Sharing

Copy URL Twitter E-mail

General

Target

e6a264207d71c60c1c77c49dcd8366877ee0de0a81c35a5ac8bb14c043500fe5
Size

15.6MB
MD5

db238eca561d45be90644aab7aa89e31
SHA1

c247e446799d777e8fb9874661575d06cf750086
SHA256

e6a264207d71c60c1c77c49dcd8366877ee0de0a81c35a5ac8bb14c043500fe5
SHA512

b74fd0c0afb4738dedc0aa0d22fc845e8d1ea0e80260da4c2c9aa1071f1ad5d8322e60d980e87bbd9503ce22bfdea20d4422569e6af8b444004401d526847f23
SSDEEP

393216:iIfyI1WAfgqPM/8sS8GDM3Z4e+7j/Ke57si:iIfyI1WAbMzTl+

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e6a264207d71c60c1c77c49dcd8366877ee0de0a81c35a5ac8bb14c043500fe5

Files

e6a264207d71c60c1c77c49dcd8366877ee0de0a81c35a5ac8bb14c043500fe5
.exe windows:6 windows x86

79eb914b5974052bb7708e8ae68397ed

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

lichking

?EnterRecoveryMode@CRestoreDevices@@QAEHPAU_IDevice@@@Z

qt5svg

??1QSvgRenderer@@UAE@XZ

qt5widgets

?addSpacerItem@QBoxLayout@@QAEXPAVQSpacerItem@@@Z

qt5gui

?horizontalAdvance@QFontMetrics@@QBEHABVQString@@H@Z

qt5network

??0QNetworkRequest@@QAE@ABVQUrl@@@Z

qt5xml

??1QDomNodeList@@QAE@XZ

qt5core

?toLongLong@QString@@QBE_JPA_NH@Z

msvcp140

_Mtx_init

dbghelp

MiniDumpWriteDump

dwmapi

DwmExtendFrameIntoClientArea

user32

GetWindowRect
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW

kernel32

WideCharToMultiByte
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

vcruntime140

_except_handler4_common

api-ms-win-crt-runtime-l1-1-0

strerror_s

api-ms-win-crt-stdio-l1-1-0

_set_fmode

api-ms-win-crt-heap-l1-1-0

calloc

api-ms-win-crt-math-l1-1-0

_ldtest

api-ms-win-crt-filesystem-l1-1-0

remove

api-ms-win-crt-string-l1-1-0

isdigit

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-time-l1-1-0

_localtime64_s

shell32

CommandLineToArgvW

wtsapi32

WTSSendMessageW

Exports

Exports

?$TSS0@?1??GetInstance@IDevicesManager@@SAPAV2@XZ@4HA
??4CRestoreDevices@@QAEAAV0@ABV0@@Z
??4CyncUnlockIOS@@QAEAAV0@ABV0@@Z
??4IDevicesManager@@QAEAAV0@ABV0@@Z
?GetInstance@IDevicesManager@@SAPAV1@XZ
?InstanceManage@?1??GetInstance@IDevicesManager@@SAPAV2@XZ@4V2@A

Sections

.text
Size: - Virtual size: 517KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 9.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 3.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 15.4MB - Virtual size: 15.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 188KB - Virtual size: 187KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

79eb914b5974052bb7708e8ae68397ed

Headers

DLL Characteristics

File Characteristics

Imports

lichking

qt5svg

qt5widgets

qt5gui

qt5network

qt5xml

qt5core

msvcp140

dbghelp

dwmapi

user32

kernel32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-time-l1-1-0

shell32

wtsapi32

Exports

Exports

Sections

.text Size: - Virtual size: 517KB

.rdata Size: - Virtual size: 9.9MB

.data Size: - Virtual size: 21KB

.vmp0 Size: - Virtual size: 3.9MB

.vmp1 Size: 15.4MB - Virtual size: 15.4MB

.reloc Size: 1KB - Virtual size: 1KB

.rsrc Size: 188KB - Virtual size: 187KB

.text
Size: - Virtual size: 517KB

.rdata
Size: - Virtual size: 9.9MB

.data
Size: - Virtual size: 21KB

.vmp0
Size: - Virtual size: 3.9MB

.vmp1
Size: 15.4MB - Virtual size: 15.4MB

.reloc
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 188KB - Virtual size: 187KB