6c7a375806714f85bd6fe3a2e97cc79b30ff3d76039eaae2894d99b722f8d328

General

Target
6c7a375806714f85bd6fe3a2e97cc79b30ff3d76039eaae2894d99b722f8d328
Size 3.6MB
Sample231202-rrm15sdd61
SHA256 6c7a375806714f85bd6fe3a2e97cc79b30ff3d76039eaae2894d99b722f8d328
MD5 26cfb8de7d27b859db6c9c78a035d1d5
SHA1 a81d0bbcb947d3dbb34e24c1fd5948b2cbf7efab
SHA512 e891fc7ba45587de44d41e1b2bdf358237b2dffa623152d55ac95d54ba10ff555f35601c07eb32573f2728c6d898e6975fead18ffa438390e6a41c056b349afb
SSDEEP 49152:3DPPp7BX7y3fTU2GKqo0XrXZkyNuZvScUAhUZBtCpk26WHC5Db9Vr/Q:ra3fT1qSbZvSDAhub6CpD7Q
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6c7a375806714f85bd6fe3a2e97cc79b30ff3d76039eaae2894d99b722f8d328

File Explorer

6c7a375806714f85bd6fe3a2e97cc79b30ff3d76039eaae2894d99b722f8d328

.exe 3.6MB

6c7a375806714f85bd6fe3a2e97cc79b30ff3d76039eaae2894d99b722f8d328

IMPHASH 3ce8afd6d13faa31e4f1628ef9489239
SHA256 6c7a375806714f85bd6fe3a2e97cc79b30ff3d76039eaae2894d99b722f8d328
MD5 26cfb8de7d27b859db6c9c78a035d1d5
SHA1 a81d0bbcb947d3dbb34e24c1fd5948b2cbf7efab
SHA512 e891fc7ba45587de44d41e1b2bdf358237b2dffa623152d55ac95d54ba10ff555f35601c07eb32573f2728c6d898e6975fead18ffa438390e6a41c056b349afb
SSDEEP 49152:3DPPp7BX7y3fTU2GKqo0XrXZkyNuZvScUAhUZBtCpk26WHC5Db9Vr/Q:ra3fT1qSbZvSDAhub6CpD7Q
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

3940536

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleA GetProcAddress SetStdHandle WriteConsoleW LoadLibraryW IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID InterlockedIncrement InterlockedDecrement EncodePointer DecodePointer Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetCommandLineA HeapSetInformation RaiseException RtlUnwind GetLastError HeapFree WideCharToMultiByte LCMapStringW MultiByteToWideChar GetCPInfo HeapAlloc SetUnhandledExceptionFilter GetModuleHandleW ExitProcess WriteFile GetStdHandle GetModuleFileNameW GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess GetCurrentProcess UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetLocaleInfoW HeapSize GetConsoleCP GetConsoleMode FlushFileBuffers ReadFile SetFilePointer CloseHandle GetACP GetOEMCP IsValidCodePage GetStringTypeW HeapReAlloc CreateFileW LocalAlloc LocalFree GetModuleFileNameW GetProcessAffinityMask SetProcessAffinityMask SetThreadAffinityMask Sleep ExitProcess FreeLibrary LoadLibraryA GetModuleHandleA GetProcAddress

ws2_32

recv closesocket connect inet_addr htons WSACleanup socket WSAStartup

user32

GetProcessWindowStation GetUserObjectInformationW

Name

.text

Size

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

3.2MB

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

425KB

Virtual Size

425KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

6c7a375806714f85bd6fe3a2e97cc79b30ff3d76039eaae2894d99b722f8d328

kernel32

ws2_32

user32

generic