e7e2f2e2510a02437a3cdb46267691e631dd6a77417e50697fb37c90e4b79c86

Sharing

Copy URL Twitter E-mail

General

Target
e7e2f2e2510a02437a3cdb46267691e631dd6a77417e50697fb37c90e4b79c86
Size 4.8MB
Sample231205-vtq3csde75
SHA256 e7e2f2e2510a02437a3cdb46267691e631dd6a77417e50697fb37c90e4b79c86
MD5 f4cb4cbfa7808d8b18d4cc5d50028837
SHA1 a8db0b37ae2ba3986507b2c5ab6c6c1965baf7b6
SHA512 8bd02a351b87445d98c1f706bef7fab7101909c97107db9745be2bd7c47ae5317abe3d98f4efacc5092083ccb88935e6e8791afd90fcc9920a232754e4fc18aa
SSDEEP 98304:51RFAcSbh2vEOt3JrL95aS89JaekN3ZzR5pYoBwbxvMiPa:Ve7bmlPrLHz89g/B+vMiS
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e7e2f2e2510a02437a3cdb46267691e631dd6a77417e50697fb37c90e4b79c86

File Explorer

e7e2f2e2510a02437a3cdb46267691e631dd6a77417e50697fb37c90e4b79c86

.exe 4.8MB

e7e2f2e2510a02437a3cdb46267691e631dd6a77417e50697fb37c90e4b79c86

IMPHASH b8b203afdd53fefb24d2540f2d05c2dd
SHA256 e7e2f2e2510a02437a3cdb46267691e631dd6a77417e50697fb37c90e4b79c86
MD5 f4cb4cbfa7808d8b18d4cc5d50028837
SHA1 a8db0b37ae2ba3986507b2c5ab6c6c1965baf7b6
SHA512 8bd02a351b87445d98c1f706bef7fab7101909c97107db9745be2bd7c47ae5317abe3d98f4efacc5092083ccb88935e6e8791afd90fcc9920a232754e4fc18aa
SSDEEP 98304:51RFAcSbh2vEOt3JrL95aS89JaekN3ZzR5pYoBwbxvMiPa:Ve7bmlPrLHz89g/B+vMiS
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3392973

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

VirtualProtect GetCurrentProcess VirtualAlloc CreateFileW UnmapViewOfFile GetCurrentThread CloseHandle CreateFileMappingW MapViewOfFile WriteConsoleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW TerminateProcess RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx GetSystemTimeAsFileTime GetModuleHandleA CreateEventA GetModuleFileNameW LoadLibraryA TerminateProcess GetCurrentProcess CreateToolhelp32Snapshot Thread32First GetCurrentProcessId GetCurrentThreadId OpenThread Thread32Next CloseHandle SuspendThread ResumeThread WriteProcessMemory GetSystemInfo VirtualAlloc VirtualProtect VirtualFree GetProcessAffinityMask SetProcessAffinityMask GetCurrentThread SetThreadAffinityMask Sleep FreeLibrary GetTickCount SystemTimeToFileTime FileTimeToSystemTime GlobalFree LocalAlloc LocalFree GetProcAddress ExitProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetModuleHandleW LoadResource MultiByteToWideChar FindResourceExW FindResourceExA WideCharToMultiByte GetThreadLocale GetUserDefaultLCID GetSystemDefaultLCID EnumResourceNamesA EnumResourceNamesW EnumResourceLanguagesA EnumResourceLanguagesW EnumResourceTypesA EnumResourceTypesW CreateFileW LoadLibraryW GetLastError FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle FlsSetValue GetCommandLineA RaiseException RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx HeapFree GetCPInfo GetACP GetOEMCP IsValidCodePage EncodePointer DecodePointer FlsGetValue FlsFree SetLastError FlsAlloc UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext HeapAlloc LCMapStringA LCMapStringW SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapSetInformation HeapCreate HeapDestroy QueryPerformanceCounter GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize WriteFile SetFilePointer GetConsoleCP GetConsoleMode HeapReAlloc InitializeCriticalSectionAndSpinCount LocalAlloc LocalFree GetModuleFileNameW GetProcessAffinityMask SetProcessAffinityMask SetThreadAffinityMask Sleep ExitProcess FreeLibrary LoadLibraryA GetModuleHandleA GetProcAddress

wtsapi32

WTSSendMessageW

user32

GetUserObjectInformationW CharUpperBuffW MessageBoxW GetProcessWindowStation GetProcessWindowStation GetUserObjectInformationW

Name

.text

Size

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vmp0

Size

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

4.8MB

Virtual Size

4.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

e7e2f2e2510a02437a3cdb46267691e631dd6a77417e50697fb37c90e4b79c86

kernel32

wtsapi32

user32

generic