a08ab9ae38fb069e6fd0b5ae376be79aab9fe0d1776fa34502d5d30043d1c940

General

Target
a08ab9ae38fb069e6fd0b5ae376be79aab9fe0d1776fa34502d5d30043d1c940
Size 2.1MB
Sample231208-br35csge49
SHA256 a08ab9ae38fb069e6fd0b5ae376be79aab9fe0d1776fa34502d5d30043d1c940
MD5 025de37f720ac6cf843c71bb9e01760c
SHA1 9e1aefa92e17caf0693a2b78befd42bc57e0184d
SHA512 072d5210bedbc6150169ab37e1ebc119fdb544ff66640adb8ebc365d75db309f5642ffbe679c3ae1a874a285ec160809113ae1d33994aef7cc84acf0a19c0749
SSDEEP 49152:i7YoGN/XMrEIdw9nrRJQov04s1/C0oWFcM4Vl5:qA/cFdw9ncoQ1/CjWFl
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a08ab9ae38fb069e6fd0b5ae376be79aab9fe0d1776fa34502d5d30043d1c940

File Explorer

a08ab9ae38fb069e6fd0b5ae376be79aab9fe0d1776fa34502d5d30043d1c940

.exe 2.1MB

a08ab9ae38fb069e6fd0b5ae376be79aab9fe0d1776fa34502d5d30043d1c940

IMPHASH 2be5bf5fef31b47c4aa7b65149f9781e
SHA256 a08ab9ae38fb069e6fd0b5ae376be79aab9fe0d1776fa34502d5d30043d1c940
MD5 025de37f720ac6cf843c71bb9e01760c
SHA1 9e1aefa92e17caf0693a2b78befd42bc57e0184d
SHA512 072d5210bedbc6150169ab37e1ebc119fdb544ff66640adb8ebc365d75db309f5642ffbe679c3ae1a874a285ec160809113ae1d33994aef7cc84acf0a19c0749
SSDEEP 49152:i7YoGN/XMrEIdw9nrRJQov04s1/C0oWFcM4Vl5:qA/cFdw9ncoQ1/CjWFl
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

3994697

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateFileA GetCurrentProcess LocalAlloc GetCurrentProcess GetCurrentThread LocalFree GetModuleFileNameW GetProcessAffinityMask SetProcessAffinityMask SetThreadAffinityMask Sleep ExitProcess GetLastError FreeLibrary LoadLibraryA GetModuleHandleA GetProcAddress

advapi32

CryptHashData RegQueryValueExA OpenSCManagerW EnumServicesStatusExW OpenServiceW QueryServiceConfigW CloseServiceHandle

qt5widgets

?setMaximum@QProgressBar@@QAEXH@Z

qt5gui

?addFile@QIcon@@QAEXABVQString@@ABVQSize@@W4Mode@1@W4State@1@@Z

qt5core

?activate@QMetaObject@@SAXPAVQObject@@PBU1@HPAPAX@Z

msvcp140

?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A

ws2_32

WSAGetLastError

vcruntime140

_except_handler4_common

api-ms-win-crt-heap-l1-1-0

malloc

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv

api-ms-win-crt-string-l1-1-0

_stricmp

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-stdio-l1-1-0

__p__commode

api-ms-win-crt-math-l1-1-0

ceil

api-ms-win-crt-filesystem-l1-1-0

_lock_file

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

shell32

CommandLineToArgvW

wtsapi32

WTSSendMessageW

user32

CharUpperBuffW

Name

.text

Size

Virtual Size

150KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

56KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

a08ab9ae38fb069e6fd0b5ae376be79aab9fe0d1776fa34502d5d30043d1c940

kernel32

advapi32

qt5widgets

qt5gui

qt5core

msvcp140

ws2_32

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

shell32

wtsapi32

user32

generic