4840eb8e119491b70a6f24908a22fbeb68428e85753222d25befd80b83610da7

Sharing

Copy URL Twitter E-mail

General

Target

4840eb8e119491b70a6f24908a22fbeb68428e85753222d25befd80b83610da7
Size

7.1MB
MD5

df2d85cd733b0cfe0e363f76cd4c8672
SHA1

2166f698c47542c0216c24474039bf68d079a724
SHA256

4840eb8e119491b70a6f24908a22fbeb68428e85753222d25befd80b83610da7
SHA512

eee1d3a5a1281b7fcc0cc62f7b2fe3d7522f68a64a05c27eccc52c4dc0b0372bc288bc06d5a46c3873c17a513ab1def1477f2f58ac5fcf90791c456c2617b594
SSDEEP

196608:RUAPajxHQ1oCDdjfvG/nYyidxtR+qAEuzxE/fuX:mAEwPDhfvG/nA7+qTveX

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
static1/unpack001/5172.exe	vmprotect

Files

4840eb8e119491b70a6f24908a22fbeb68428e85753222d25befd80b83610da7
.zip
5172.exe
.exe windows:5 windows x64

c668ad1c9b30fa8934d8b3222ff3cef5

Code Sign

68:a8:56:bb:e7:cc:da:e9:55:78:15:0c:7e:b3:87:63:36:d6:f4:e2
Certificate

Issuer

L=Hong Kong,ST=Central and Western District,C=HK

Not Before

24/04/2023, 03:03

Not After

23/04/2024, 03:03

Subject

L=Hong Kong,ST=Central and Western District,C=HK

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageKeyEncipherment

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

68:a8:56:bb:e7:cc:da:e9:55:78:15:0c:7e:b3:87:63:36:d6:f4:e2
Certificate

Issuer

L=Hong Kong,ST=Central and Western District,C=HK

Not Before

24/04/2023, 03:03

Not After

23/04/2024, 03:03

Subject

L=Hong Kong,ST=Central and Western District,C=HK

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageKeyEncipherment

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c1:8f:fe:c7:58:b7:d4:98:1b:c0:41:cb:3a:51:35:dd:69:8a:5c:1c:7f:cd:c5:ea:f9:91:d3:ad:7f:17:ab:25
Signer

Actual PE Digest

c1:8f:fe:c7:58:b7:d4:98:1b:c0:41:cb:3a:51:35:dd:69:8a:5c:1c:7f:cd:c5:ea:f9:91:d3:ad:7f:17:ab:25

Digest Algorithm

sha256

PE Digest Matches

true

bb:14:0e:de:64:59:5b:56:4e:2a:da:61:87:e9:ce:d1:fc:4f:07:ef
Signer

Actual PE Digest

bb:14:0e:de:64:59:5b:56:4e:2a:da:61:87:e9:ce:d1:fc:4f:07:ef

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetVersion
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

CreateAcceleratorTableA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW

gdi32

GetObjectType

msimg32

TransparentBlt

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA

advapi32

RegEnumKeyExA

shell32

SHGetSpecialFolderLocation

comctl32

InitCommonControlsEx

shlwapi

PathFindFileNameA

ole32

OleLockRunning

oleaut32

SysFreeString

oledlg

ord8

gdiplus

GdipGetImageGraphicsContext

wininet

InternetCloseHandle

oleacc

LresultFromObject

imm32

ImmReleaseContext

winmm

PlaySoundA

wtsapi32

WTSSendMessageW

Sections

.text
Size: - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 680KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

text
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE

data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 5.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 7.4MB - Virtual size: 7.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c668ad1c9b30fa8934d8b3222ff3cef5

Code Sign

68:a8:56:bb:e7:cc:da:e9:55:78:15:0c:7e:b3:87:63:36:d6:f4:e2Certificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

68:a8:56:bb:e7:cc:da:e9:55:78:15:0c:7e:b3:87:63:36:d6:f4:e2Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

c1:8f:fe:c7:58:b7:d4:98:1b:c0:41:cb:3a:51:35:dd:69:8a:5c:1c:7f:cd:c5:ea:f9:91:d3:ad:7f:17:ab:25Signer

bb:14:0e:de:64:59:5b:56:4e:2a:da:61:87:e9:ce:d1:fc:4f:07:efSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

oledlg

gdiplus

wininet

oleacc

imm32

winmm

wtsapi32

Sections

.text Size: - Virtual size: 1.9MB

.rdata Size: - Virtual size: 680KB

.data Size: - Virtual size: 86KB

.pdata Size: - Virtual size: 91KB

text Size: - Virtual size: 2KB

data Size: - Virtual size: 1KB

.vmp0 Size: - Virtual size: 5.5MB

.vmp1 Size: 7.4MB - Virtual size: 7.4MB

.rsrc Size: 30KB - Virtual size: 30KB

68:a8:56:bb:e7:cc:da:e9:55:78:15:0c:7e:b3:87:63:36:d6:f4:e2
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

68:a8:56:bb:e7:cc:da:e9:55:78:15:0c:7e:b3:87:63:36:d6:f4:e2
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

c1:8f:fe:c7:58:b7:d4:98:1b:c0:41:cb:3a:51:35:dd:69:8a:5c:1c:7f:cd:c5:ea:f9:91:d3:ad:7f:17:ab:25
Signer

bb:14:0e:de:64:59:5b:56:4e:2a:da:61:87:e9:ce:d1:fc:4f:07:ef
Signer

.text
Size: - Virtual size: 1.9MB

.rdata
Size: - Virtual size: 680KB

.data
Size: - Virtual size: 86KB

.pdata
Size: - Virtual size: 91KB

text
Size: - Virtual size: 2KB

data
Size: - Virtual size: 1KB

.vmp0
Size: - Virtual size: 5.5MB

.vmp1
Size: 7.4MB - Virtual size: 7.4MB

.rsrc
Size: 30KB - Virtual size: 30KB