b84caef9be88599d77ef18b99a9caa9000917f8037d4e09d77d43247239f96cb

Sharing

Copy URL Twitter E-mail

General

Target
b84caef9be88599d77ef18b99a9caa9000917f8037d4e09d77d43247239f96cb
Size 353KB
Sample231208-tae1baagep
SHA256 b84caef9be88599d77ef18b99a9caa9000917f8037d4e09d77d43247239f96cb
MD5 ba317f0376170fe9cc11538c04c24f93
SHA1 edeb893d8284872f46ac413e9a8a3830f942b5ec
SHA512 6546fcc739d3422df4e05862fc85f52b513d1413c20ebf9cb64badf4dfde7bdf8ce16849d5bb5d98fba480207ecb48f164ca95f93a224d762fa3fcbe4733be38
SSDEEP 6144:VyFDGLrtY9zMylinh2NlAJzZvP5cfpBzIojglnNrSBj6RbzeTBq:8DitkAyQYNlAJVZ6Bzf0lNeBofmI
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

File Explorer

b84caef9be88599d77ef18b99a9caa9000917f8037d4e09d77d43247239f96cb

.sys 353KB

b84caef9be88599d77ef18b99a9caa9000917f8037d4e09d77d43247239f96cb

IMPHASH f4f1cdd29f251ad6e27761e0589fc58e
SHA256 b84caef9be88599d77ef18b99a9caa9000917f8037d4e09d77d43247239f96cb
MD5 ba317f0376170fe9cc11538c04c24f93
SHA1 edeb893d8284872f46ac413e9a8a3830f942b5ec
SHA512 6546fcc739d3422df4e05862fc85f52b513d1413c20ebf9cb64badf4dfde7bdf8ce16849d5bb5d98fba480207ecb48f164ca95f93a224d762fa3fcbe4733be38
SSDEEP 6144:VyFDGLrtY9zMylinh2NlAJzZvP5cfpBzIojglnNrSBj6RbzeTBq:8DitkAyQYNlAJVZ6Bzf0lNeBofmI
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x64 arch:x64

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect

PE Signature issue

Digest

37:3e:da:0d:62:a2:c8:d3:82:66:33:62:af:5f:a2:3b:b6:67:66:b7

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Wuhan Xianxingzhe Technology Company Limited,O=Wuhan Xianxingzhe Technology Company Limited,L=Wuhan,ST=Hubei,C=CN

Chains

Dec 6, 2023

Subject

CN=Wuhan Xianxingzhe Technology Company Limited,O=Wuhan Xianxingzhe Technology Company Limited,L=Wuhan,ST=Hubei,C=CN

Serial Number

14:c2:ab:9d:bc:ca:63:4f:4e:b9:60:f4:18:57:dd:a1

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 3, 2015 - May 3, 2016

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

33:00:00:00:36:7b:02:ea:cd:06:50:7a:73:00:00:00:00:00:36

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 15, 2013 - Aug 15, 2023

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Serial Number

6b:da:df:ef:f0:66:1b:d2:64:2a:f4:6e:cb:b2:79:40

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Timespan

Jul 9, 1999 - Jul 9, 2019

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Serial Number

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Aug 8, 2009 - Aug 8, 2024

Minor OS version

Major OS version

Entry point

359589

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

fltmgr.sys

FltEnumerateFilters FltObjectDereference FltSetCallbackDataDirty FltRegisterFilter FltUnregisterFilter FltStartFiltering FltGetFileNameInformation FltReleaseFileNameInformation FltParseFileNameInformation FltCreateFile FltQueryInformationFile FltSetInformationFile FltClose

ntoskrnl.exe

PsLookupProcessByProcessId ObOpenObjectByPointer KeInitializeApc KeInsertQueueApc PsProcessType ExAllocatePoolWithTag ExFreePoolWithTag KeInitializeEvent KeSetEvent IoAllocateIrp IofCallDriver IoCreateFile IoFreeIrp IoGetRelatedDeviceObject IoFileObjectType KeEnterCriticalRegion KeLeaveCriticalRegion ExInitializeResourceLite ExAcquireResourceSharedLite ExAcquireResourceExclusiveLite ExReleaseResourceLite PsGetProcessId PsGetProcessWow64Process PsGetProcessImageFileName PsGetProcessInheritedFromUniqueProcessId KeStackAttachProcess KeUnstackDetachProcess ZwAllocateVirtualMemory MmProbeAndLockPages IoAllocateMdl IoBuildDeviceIoControlRequest IoFreeMdl ZwCreateFile __C_specific_handler DbgPrint IofCompleteRequest RtlCopyUnicodeString KeAreAllApcsDisabled MmMapLockedPagesSpecifyCache IoGetCurrentProcess ZwQueryInformationFile PsGetCurrentProcessId PsGetCurrentThreadId IoReplaceFileObjectName ExInterlockedInsertTailList ExInterlockedRemoveHeadList ZwWriteFile PsGetThreadId ExQueueWorkItem CmUnRegisterCallback ZwUnloadDriver PsSetCreateProcessNotifyRoutine KeAcquireSpinLockRaiseToDpc PsSetCreateThreadNotifyRoutine PsRemoveCreateThreadNotifyRoutine PsSetLoadImageNotifyRoutine PsRemoveLoadImageNotifyRoutine IoQueryFileDosDeviceName ObfDereferenceObject ObRegisterCallbacks ObUnRegisterCallbacks ObGetFilterVersion PsThreadType CmRegisterCallback ObQueryNameString IoAllocateWorkItem IoFreeWorkItem IoQueueWorkItem PsLookupThreadByThreadId IoThreadToProcess IoCreateDevice IoDeleteDevice RtlTimeToTimeFields ExSystemTimeToLocalTime KeDelayExecutionThread ZwFreeVirtualMemory ZwWaitForSingleObject ZwQuerySystemInformation ZwQueryInformationThread ExAllocatePool wcscpy_s RtlUnicodeStringToInteger RtlCompareUnicodeString KeQueryTimeIncrement MmUnlockPages MmBuildMdlForNonPagedPool MmMapLockedPages MmUnmapLockedPages PsTerminateSystemThread ZwOpenFile ZwSetInformationFile ZwReadFile ZwCreateKey ZwQueryValueKey ZwSetValueKey ZwOpenSymbolicLinkObject RtlCharToInteger RtlVolumeDeviceToDosName ZwTerminateProcess PsIsSystemThread ZwOpenDirectoryObject ZwQueryInformationProcess PsGetProcessPeb RtlImageNtHeader MmSystemRangeStart RtlUTF8ToUnicodeN ExInterlockedInsertHeadList IoCreateSymbolicLink IoDeleteSymbolicLink RtlGetVersion RtlMultiByteToUnicodeN RtlUnicodeToMultiByteSize RtlUnicodeToMultiByteN RtlAnsiCharToUnicodeChar KeBugCheckEx ObReferenceObjectByHandle PsCreateSystemThread MmGetSystemRoutineAddress KeWaitForSingleObject MmIsAddressValid ZwUnmapViewOfSection ZwMapViewOfSection ZwOpenSection ZwCreateSection ProbeForWrite ProbeForRead ZwQuerySymbolicLinkObject ZwClose PsGetProcessSectionBaseAddress KeReleaseSpinLock RtlInitUnicodeString PsSetCreateProcessNotifyRoutineEx IoAttachDevice IoDetachDevice IoSetCompletionRoutineEx strcpy_s IoAllocateMdl MmProbeAndLockPages MmMapLockedPagesSpecifyCache MmUnlockPages IoFreeMdl ExAllocatePool ExFreePool NtQuerySystemInformation

tdi.sys

TdiMapUserRequest

hal

HalMakeBeep

Name

.text

Size

174KB

Virtual Size

174KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp0

Size

73KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

60KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

376B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

492B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

b84caef9be88599d77ef18b99a9caa9000917f8037d4e09d77d43247239f96cb

PE Signature issue

fltmgr.sys

ntoskrnl.exe

tdi.sys

hal

generic