49c2efb3f6420a2f3a01e661828ed9c2215f9039b969a26475afd7aebac7c83e[.]exe[.]zip

General

Target

49c2efb3f6420a2f3a01e661828ed9c2215f9039b969a26475afd7aebac7c83e.exe.zip
Size

2.6MB
MD5

11af1df98dfdea38021588b2fd08c553
SHA1

42f3cb364b29fa6971f0c60832c5d723834c2d21
SHA256

c588cfdbea735082020cc241f47c45b8b3e4d939ba072ce144861fbe44579747
SHA512

7b67c9bf5e2f0505a1b47893ed7109d2ddb82a303402556a7abb15f262ba2c572f98c6fd81332c7a8b9efeb4598a08dbe382e7b33b555f2dafefbf070c49cbd6
SSDEEP

49152:UVUL5oLHm9qcgTO4kcbkBCCNI/VONkBrxyFi4MhGjKq9JAGJMFLwNrS:6UTETVNKc/VOGt4Fi4MhGWiAGJMpwI

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
static1/unpack001/49c2efb3f6420a2f3a01e661828ed9c2215f9039b969a26475afd7aebac7c83e.exe	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/49c2efb3f6420a2f3a01e661828ed9c2215f9039b969a26475afd7aebac7c83e.exe

Files

49c2efb3f6420a2f3a01e661828ed9c2215f9039b969a26475afd7aebac7c83e.exe.zip
.zip

Password: infected
49c2efb3f6420a2f3a01e661828ed9c2215f9039b969a26475afd7aebac7c83e.exe
.exe windows:4 windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

?interfaceMap@CCustomControlSite@@1UAFX_INTERFACEMAP@@B

Sections

.text
Size: 744KB - Virtual size: 744KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 440KB - Virtual size: 440KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 48KB - Virtual size: 324KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 148KB - Virtual size: 148KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.newimp
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.enigma1
Size: 268KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.enigma2
Size: 244KB - Virtual size: 244KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Password: infected

Headers

File Characteristics

Exports

Exports

Sections

.text Size: 744KB - Virtual size: 744KB

.rdata Size: 440KB - Virtual size: 440KB

.data Size: 48KB - Virtual size: 324KB

.vmp0 Size: 1.4MB - Virtual size: 1.4MB

.vmp1 Size: 148KB - Virtual size: 148KB

.rsrc Size: 1.4MB - Virtual size: 1.4MB

.newimp Size: 4KB - Virtual size: 4KB

.enigma1 Size: 268KB - Virtual size: 4KB

.enigma2 Size: 244KB - Virtual size: 244KB

.text
Size: 744KB - Virtual size: 744KB

.rdata
Size: 440KB - Virtual size: 440KB

.data
Size: 48KB - Virtual size: 324KB

.vmp0
Size: 1.4MB - Virtual size: 1.4MB

.vmp1
Size: 148KB - Virtual size: 148KB

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

.newimp
Size: 4KB - Virtual size: 4KB

.enigma1
Size: 268KB - Virtual size: 4KB

.enigma2
Size: 244KB - Virtual size: 244KB