37bb29c52acda851b77cf5fac6bfc69f4ef1579327c01c8c1e2af7d7cd8f5e2b

Sharing

Copy URL Twitter E-mail

General

Target
37bb29c52acda851b77cf5fac6bfc69f4ef1579327c01c8c1e2af7d7cd8f5e2b
Size 1.8MB
Sample231202-rnmafadd86
SHA256 37bb29c52acda851b77cf5fac6bfc69f4ef1579327c01c8c1e2af7d7cd8f5e2b
MD5 da2eaad794d103953d7481525c18e4ac
SHA1 101b320c140ca7ce0d076997b0a02bfc3e1e4e4d
SHA512 8b1fb946c68da2477336e3be0f82dbc8c8be28186030d77800a15263b0dca61dfb33bf8aa9213760564c882bc3952a207fca8ac9575f4a13363e1ce5b635eaca
SSDEEP 49152:v2LhN8On3Qk1Cqub5zxU0OH/Ow1SDziuqnrW:uFN8On3OqGDOWwQAW
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
37bb29c52acda851b77cf5fac6bfc69f4ef1579327c01c8c1e2af7d7cd8f5e2b

File Explorer

37bb29c52acda851b77cf5fac6bfc69f4ef1579327c01c8c1e2af7d7cd8f5e2b

.dll 1.8MB

37bb29c52acda851b77cf5fac6bfc69f4ef1579327c01c8c1e2af7d7cd8f5e2b

IMPHASH 64f19704cc2dfe31d012299f0ed6cb2e
SHA256 37bb29c52acda851b77cf5fac6bfc69f4ef1579327c01c8c1e2af7d7cd8f5e2b
MD5 da2eaad794d103953d7481525c18e4ac
SHA1 101b320c140ca7ce0d076997b0a02bfc3e1e4e4d
SHA512 8b1fb946c68da2477336e3be0f82dbc8c8be28186030d77800a15263b0dca61dfb33bf8aa9213760564c882bc3952a207fca8ac9575f4a13363e1ce5b635eaca
SSDEEP 49152:v2LhN8On3Qk1Cqub5zxU0OH/Ow1SDziuqnrW:uFN8On3OqGDOWwQAW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4782990

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Name

.text

Size

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

138KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp1

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

156B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

4KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

37bb29c52acda851b77cf5fac6bfc69f4ef1579327c01c8c1e2af7d7cd8f5e2b

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

oledlg

ole32

olepro32

oleaut32

wsock32

generic