impact_cracked[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
impact_cracked.exe
Size 6.1MB
Sample231210-d2k3msddd9
SHA256 20ffe6d5ffeefecc28bef795ba84e3bb8339522e103c32705b0360f24051b12c
MD5 f8164877a685b3ff1aa8a4c7292e699c
SHA1 279aba8c802d15f3507210b6bf702b678e30f5a3
SHA512 f381a0789c50a89022acfc764766931ee43577637f6e11240ee6eade6a62f5e84a8c8b68fd2b240eddf184278693279e8a84a4863f2025f568e8acf0833d653c
SSDEEP 98304:IB38757d1xzB92ETr/SG/e6ML0kySVPziZ42xBTBcSn7JNXjEFsZg5:Gs7D1xH3/SG/KL0fSNmZ9xhBj7zzes6
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
impact_cracked.exe

File Explorer

impact_cracked.exe

.exe 6.1MB

impact_cracked.exe

IMPHASH 0b8cb48661032bcdf6a803b39d169c63
SHA256 20ffe6d5ffeefecc28bef795ba84e3bb8339522e103c32705b0360f24051b12c
MD5 f8164877a685b3ff1aa8a4c7292e699c
SHA1 279aba8c802d15f3507210b6bf702b678e30f5a3
SHA512 f381a0789c50a89022acfc764766931ee43577637f6e11240ee6eade6a62f5e84a8c8b68fd2b240eddf184278693279e8a84a4863f2025f568e8acf0833d653c
SSDEEP 98304:IB38757d1xzB92ETr/SG/e6ML0kySVPziZ42xBTBcSn7JNXjEFsZg5:Gs7D1xH3/SG/KL0fSNmZ9xhBj7zzes6
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6282994

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d9

Direct3DCreate9

kernel32

LeaveCriticalSection GetSystemTimeAsFileTime LocalAlloc LocalFree GetModuleFileNameW GetProcessAffinityMask SetProcessAffinityMask SetThreadAffinityMask Sleep ExitProcess FreeLibrary LoadLibraryA GetModuleHandleA GetProcAddress

user32

SetCursorPos GetUserObjectInformationW GetProcessWindowStation GetUserObjectInformationW

gdi32

GetDeviceCaps

shell32

ShellExecuteA

msvcp140

?wcerr@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A

imm32

ImmSetCompositionWindow

normaliz

IdnToAscii

wldap32

ord301

crypt32

CertGetNameStringA

ws2_32

ntohl

rpcrt4

UuidCreate

psapi

GetModuleInformation

userenv

UnloadUserProfile

vcruntime140

__std_exception_copy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

strcpy_s

api-ms-win-crt-runtime-l1-1-0

_getpid

api-ms-win-crt-stdio-l1-1-0

_wfopen

api-ms-win-crt-heap-l1-1-0

malloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-math-l1-1-0

cosf

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-filesystem-l1-1-0

_unlink

advapi32

CryptHashData

wtsapi32

WTSSendMessageW

Name

.text

Size

Virtual Size

799KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

609KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vmp0

Size

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

6.1MB

Virtual Size

6.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

172B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

impact_cracked.exe

d3d9

kernel32

user32

gdi32

shell32

msvcp140

imm32

normaliz

wldap32

crypt32

ws2_32

rpcrt4

psapi

userenv

vcruntime140

vcruntime140_1

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

advapi32

wtsapi32

generic