Ghost Cosmetics Premium[.]exe | Triage

Resubmissions

09-12-2023 15:55

231209-tcxyxahcaj 10

Sharing

General

Target

Ghost Cosmetics Premium.exe
Size

16.3MB
MD5

5c55e14e94c0e65e5e5965a2a45cd6d7
SHA1

e646d601e67b80e98412efb254c6f9230b711823
SHA256

d3a0ed9c610f5222c36c47cbcf31586ece30fcc4e1ef758d9ea40e40650a2e8d
SHA512

585e8b54e2f7e9cbb35a2a98adc2b520d9e9a947f708e7b67c739b44813660fa3f4964bfde33f29f146e128c060260d6eded3464bf9b3ec1ec274b9ce1823263
SSDEEP

393216:RbGRYyAZtRPGh6YDhim6uLTi093Fq6zph+LvvLUqW01fiO:Rts6YDhiR0TD91qkph+HR

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs
Detects executables packed with VMProtect commercial packer.
vmprotect

Processes:

resource yara_rule

sample vmprotect
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

Ghost Cosmetics Premium.exe

Files

Ghost Cosmetics Premium.exe
.exe windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: - Virtual size: 8.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 16.3MB - Virtual size: 16.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ