84e3df6b415ad077cb5bd639e67653c96f1bc7d26b016aae8784b92c34963fb0

General

Target
84e3df6b415ad077cb5bd639e67653c96f1bc7d26b016aae8784b92c34963fb0
Size 330KB
Sample231211-jsn1tsada5
SHA256 84e3df6b415ad077cb5bd639e67653c96f1bc7d26b016aae8784b92c34963fb0
MD5 022208d4a5a39f35c4208f6d1015ec87
SHA1 bd756c299f2d20870dc6fba073d52080ddf2c44c
SHA512 f790c534a1984a962d1517ac49cfdfb2f557d7f5ca92b45b522426609958e0fd2f36cd11cfc2c471249ba6304f13cf24936ddac35cbb461f9ea53c1a414eb119
SSDEEP 6144:+/VKP+xsudAM6JWGsSPhhStpC61i9VsKmIEUuW6Ndnrnx:+APssUw1LS7i9VsptUufrnx
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
84e3df6b415ad077cb5bd639e67653c96f1bc7d26b016aae8784b92c34963fb0

File Explorer

84e3df6b415ad077cb5bd639e67653c96f1bc7d26b016aae8784b92c34963fb0

.dll 330KB

84e3df6b415ad077cb5bd639e67653c96f1bc7d26b016aae8784b92c34963fb0

IMPHASH a6e82773bf02c73bff6f490138f6feec
SHA256 84e3df6b415ad077cb5bd639e67653c96f1bc7d26b016aae8784b92c34963fb0
MD5 022208d4a5a39f35c4208f6d1015ec87
SHA1 bd756c299f2d20870dc6fba073d52080ddf2c44c
SHA512 f790c534a1984a962d1517ac49cfdfb2f557d7f5ca92b45b522426609958e0fd2f36cd11cfc2c471249ba6304f13cf24936ddac35cbb461f9ea53c1a414eb119
SSDEEP 6144:+/VKP+xsudAM6JWGsSPhhStpC61i9VsKmIEUuW6Ndnrnx:+APssUw1LS7i9VsptUufrnx
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

646477

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

??0CFilterAND@Data@@QAE@ABV01@@Z ??0CFilterAND@Data@@QAE@XZ ??0CFilterOR@Data@@QAE@ABV01@@Z ??0CFilterOR@Data@@QAE@XZ ??0CFilterOption@Data@@QAE@XZ ??0CPerfRecord@Perf@@QAE@XZ ??0CSplitData@Data@@QAE@XZ ??0DwBusObject@@QAE@ABV0@@Z ??0DwBusObject@@QAE@PBD@Z ??0DwI18n@@AAE@XZ ??0DwNetworkDetector@@QAE@XZ ??0DwQueuedFunc@@AAE@XZ ??0_connection_base@sigslot@@QAE@ABV01@@Z ??0_connection_base@sigslot@@QAE@ABVslot_holder@has_slots@1@PAX@Z ??0_connection_base@sigslot@@QAE@XZ ??0connection_holder@_connection_base@sigslot@@QAE@ABV012@@Z ??0connection_holder@_connection_base@sigslot@@QAE@PBV12@@Z ??0has_slots@sigslot@@QAE@ABV01@@Z ??0has_slots@sigslot@@QAE@XZ ??0slot_holder@has_slots@sigslot@@QAE@ABV012@@Z ??0slot_holder@has_slots@sigslot@@QAE@PAVslot_wrapper@12@@Z ??0slot_wrapper@has_slots@sigslot@@QAE@PAV12@@Z ??1CFilterAND@Data@@QAE@XZ ??1CFilterOR@Data@@QAE@XZ ??1CFilterOption@Data@@QAE@XZ ??1CSplitData@Data@@QAE@XZ ??1DwBusObject@@UAE@XZ ??1DwI18n@@AAE@XZ ??1DwNetworkDetector@@UAE@XZ ??1DwQueuedFunc@@AAE@XZ ??1_connection_base@sigslot@@UAE@XZ ??1connection_holder@_connection_base@sigslot@@QAE@XZ ??1has_slots@sigslot@@UAE@XZ ??1slot_holder@has_slots@sigslot@@QAE@XZ ??1slot_wrapper@has_slots@sigslot@@QAE@XZ ??4CFilterAND@Data@@QAEAAV01@ABV01@@Z ??4CFilterOR@Data@@QAEAAV01@ABV01@@Z ??4CFilterOption@Data@@QAEAAV01@ABV01@@Z ??4CPerfRecord@Perf@@QAEAAV01@$$QAV01@@Z ??4CPerfRecord@Perf@@QAEAAV01@ABV01@@Z ??4CSplitData@Data@@QAEAAV01@ABV01@@Z ??4DwBus@@QAEAAV0@ABV0@@Z ??4DwBusObject@@QAEAAV0@ABV0@@Z ??4DwI18n@@QAEAAV0@ABV0@@Z ??4DwQueuedFunc@@QAEAAV0@ABV0@@Z ??4EventStream@@QAEAAV0@$$QAV0@@Z ??4EventStream@@QAEAAV0@ABV0@@Z ??4_connection_base@sigslot@@QAEAAV01@ABV01@@Z ??4connection_holder@_connection_base@sigslot@@QAEAAV012@ABV012@@Z ??4has_slots@sigslot@@QAEAAV01@ABV01@@Z ??4slot_holder@has_slots@sigslot@@QAEAAV012@ABV012@@Z ??4slot_holder@has_slots@sigslot@@QAEAAV012@PAVslot_wrapper@12@@Z ??4slot_wrapper@has_slots@sigslot@@QAEAAV012@ABV012@@Z ??BCFilterAND@Data@@QBEPBUCFilter@1@XZ ??BCFilterOR@Data@@QBEPBUCFilter@1@XZ ??BCFilterOption@Data@@QBEPBV01@XZ ??Bconnection_holder@_connection_base@sigslot@@QAEPAV12@XZ ??Bconnection_holder@_connection_base@sigslot@@QBEPBV12@XZ ??Bslot_holder@has_slots@sigslot@@QAEPAVslot_wrapper@12@XZ ??Bslot_holder@has_slots@sigslot@@QBEPBVslot_wrapper@12@XZ ??Cconnection_holder@_connection_base@sigslot@@QAEPAV12@XZ ??Cconnection_holder@_connection_base@sigslot@@QBEPBV12@XZ ??Cslot_holder@has_slots@sigslot@@QBEPAVslot_wrapper@12@XZ ??_7CFilterAND@Data@@6B@ ??_7CFilterOR@Data@@6B@ ??_7DwBusObject@@6B@ ??_7DwNetworkDetector@@6B@ ??_7_connection_base@sigslot@@6B@ ??_7has_slots@sigslot@@6B@ ??_FDwBusObject@@QAEXXZ ??_Fconnection_holder@_connection_base@sigslot@@QAEXXZ ??_Fslot_holder@has_slots@sigslot@@QAEXXZ ?AND@CFilterAND@Data@@QAEAAV12@PBUCFilter@2@@Z ?AddToStrTable@Perf@@YAGPBD@Z ?DoLog2@@YAXGPBD0G0PB_W0@Z ?DoLog@@YAXGPBD0G0PB_W@Z ?EnablePerfStub@Perf@@YAXH@Z ?EndPerfLog@CPerfRecord@Perf@@QAEXXZ ?EndPerfLog@Perf@@YAXXZ ?FlushLog@@YAXPB_W@Z ?GetAverageStubTime@Perf@@YAGPBDK@Z ?GetInstance@CPerfRecord@Perf@@SAPAV12@XZ ?GetLastLog@@YAXPB_WKKPADK@Z ?GetLogInfo@@YA_KXZ ?GetLogInstance@@YAPAULogExport@@PB_W@Z ?GetLogMaximumFileSize@@YAKXZ ?GetPerfLogLevel@Perf@@YAKXZ ?GetStubs@Perf@@YAXAAV?$vector@UStubTag@Perf@@V?$allocator@UStubTag@Perf@@@std@@@std@@@Z ?IsLogLevelEnabled@@YA_NG@Z ?MultiPerfCalc@Perf@@YAXXZ ?MultiPerfInit@Perf@@YAXXZ ?MultiPerfStub@Perf@@YAXPBDW4E_LOG_TYPE@1@@Z ?MultiPerfUnInit@Perf@@YAXXZ ?Record@Perf@@YAXW4E_LOG_TYPE@1@GGG@Z ?SetLogFilter@@YAXP6AXGPBD0PB_W@Z@Z ?SetLogInfo2@@YAX_K@Z ?SetLogInfo@@YAXK@Z ?SetLogMaximumFileSize@@YAXK@Z ?SetPerfLogFile@CPerfRecord@Perf@@QAEXPB_W@Z ?SetPerfLogFile@Perf@@YAXPB_W@Z ?SetThreadName@Perf@@YAXKPBD@Z ?SetThreadSampling@Perf@@YAXKH@Z ?StartPerfLog@CPerfRecord@Perf@@QAEXPB_W@Z ?StartPerfLog@Perf@@YAXPB_W@Z ?Stub@Perf@@YAXW4E_LOG_TYPE@1@PBDG@Z ?__PerfLogBegin@Perf@@YAXGPBD0@Z ?__PerfLogEnd@Perf@@YAXGPBD0@Z ?_logicLayer@DwNetworkDetector@@AAE_NXZ ?_private@CFilterAND@Data@@UBEPBVCConditionExpr@2@XZ ?_private@CFilterOR@Data@@UBEPBVCConditionExpr@2@XZ ?_private@CFilterOption@Data@@QBEPBVCFilterOptionPrivate@2@XZ ?_private@CSplitData@Data@@QBEPBVCSplitDataPrivate@2@XZ ?_reportLayer@DwNetworkDetector@@AAE_NXZ ?_threadProc@DwNetworkDetector@@AAEIXZ ?_threadStub@DwNetworkDetector@@CGIPAX@Z ?_triggerLayer@DwNetworkDetector@@AAE_NXZ ?addElse@CSplitData@Data@@QAEXH@Z ?addElseIf@CSplitData@Data@@QAEXPBUCFilter@2@H@Z ?addEvent@EventStream@@SAXPBD0_K0@Z ?addEventWithToken@EventStream@@SAXPBD0_K00@Z ?addIf@CSplitData@Data@@QAEXPBUCFilter@2@H@Z ?addref@slot_wrapper@has_slots@sigslot@@QAEJXZ ?asyncCall@DwBus@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@00@Z ?bindAnotherDatabaseId@Data@@YAX_K0@Z ?call@DwBus@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV23@00@Z ?channelAddonBlackList@DwI18n@@SA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ ?channelAddonWhiteList@DwI18n@@SA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ ?clear@DwQueuedFunc@@QAEXXZ ?coCreateComInstance@@YA_NPBDPAUIUnk@@AAV?$comptr@UIUnk@@@@@Z ?comMgr@@YAPAUIDWComMgr@@XZ ?componentBlackList@DwI18n@@SA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ ?componentDebugList@DwI18n@@SA?AV?$vector@IV?$allocator@I@std@@@std@@XZ ?componentSdkVersion@@YAIXZ ?componentSdkVersionString@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ ?componentSdkVersionStringHex@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ ?componentTestEnvironment@DwI18n@@SAHXZ ?componentTestPath@DwI18n@@SA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ ?componentWhiteList@DwI18n@@SA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ ?connectSignal@DwBus@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0PAVDwBusObject@@0@Z ?createDatabase@Data@@YA?AV?$comptr@UIDatabase@Data@@@@_K@Z ?currentMSecsSinceEpoch@EventStream@@SA_KXZ ?defaultFontName@DwI18n@@SA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ ?defaultFontSize@DwI18n@@SAHXZ ?disconnect_all@has_slots@sigslot@@QAEXXZ ?dropDatabase@Data@@YAX_K@Z ?emitSignal@DwBusObject@@IAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z ?enableAsyncCall@DwBus@@SA_NXZ ?equal@CFilterAND@Data@@QAEAAV12@ABUNAME_ID@@ABUDWVariant@2@@Z ?get@slot_wrapper@has_slots@sigslot@@QBEPAV23@XZ ?getGlobalDatabase@Data@@YA?AV?$comptr@UIDatabase@Data@@@@XZ ?getSigPoll@DwQueuedFunc@@QAEAAV?$signal@$$A6AXXZ@xsignals@@XZ ?get_emitter@_connection_base@sigslot@@QBEPAXXZ ?get_receiver@has_slots@sigslot@@QAEABVslot_holder@12@XZ ?getdest@_connection_base@sigslot@@QBEPAVhas_slots@2@XZ ?greater@CFilterAND@Data@@QAEAAV12@ABUNAME_ID@@ABUDWVariant@2@@Z ?init@EventStream@@SAXXZ ?instance@DwQueuedFunc@@SAPAV1@XZ ?isChinese@DwI18n@@SA_NXZ ?isFeatureEnabled@DwI18n@@SA_NW4FeatureType@1@@Z ?less@CFilterAND@Data@@QAEAAV12@ABUNAME_ID@@ABUDWVariant@2@@Z ?listDefaultFontName@DwI18n@@SA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ ?listDefaultFontSize@DwI18n@@SAHXZ ?majorVersion@@YAIXZ ?minorVersion@@YAIXZ ?modified@CFilterAND@Data@@QAEAAV12@ABUNAME_ID@@@Z ?mp_alloc@@YAPAXI@Z ?mp_dump@@YAXXZ ?mp_dump_block@@YAXPBX@Z ?mp_free@@YAXPAX@Z ?mp_realloc@@YAPAXPAXI@Z ?mp_size@@YAIPBX@Z ?name@DwBusObject@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?newEventStream@EventStream@@SAXPBD0_K0@Z ?newEventStreamWithToken@EventStream@@SAXPBD0_K00@Z ?notEqual@CFilterAND@Data@@QAEAAV12@ABUNAME_ID@@ABUDWVariant@2@@Z ?notNull@CFilterAND@Data@@QAEAAV12@ABUNAME_ID@@@Z ?null@CFilterAND@Data@@QAEAAV12@ABUNAME_ID@@@Z ?orderBy@CFilterOption@Data@@QAEAAV12@ABUNAME_ID@@H@Z ?patchVersion@@YAIXZ ?poll@DwQueuedFunc@@QAEXXZ ?post@DwQueuedFunc@@QAEXP6GXPAX@Z0@Z ?push@CFilterOR@Data@@QAEAAV12@PBUCFilter@2@@Z ?queryDatabase@Data@@YA?AV?$comptr@UIDatabase@Data@@@@_K@Z ?queryUrl@DwI18n@@SA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@W4UrlPath@1@@Z ?release@slot_wrapper@has_slots@sigslot@@QAEJXZ ?reportEventStream@EventStream@@SAXPBD@Z ?reportEventStreamWithToken@EventStream@@SAXPBD0@Z ?s_pImpl@?1??GetInstance@CPerfRecord@Perf@@SAPAV23@XZ@4PAV23@A ?setLimit@CFilterOption@Data@@QAEAAV12@K@Z ?setSplitBy@CSplitData@Data@@QAEXABUNAME_ID@@@Z ?sigDatabaseCreated@Data@@YAAAV?$signal@$$A6AX_K@Z@xsignals@@XZ ?singleEvent@EventStream@@SAXPBD_K0@Z ?split@CSplitData@Data@@QAEHPAUIRowArray@2@AAV?$vector@UGROUP@CSplitData@Data@@V?$allocator@UGROUP@CSplitData@Data@@@std@@@std@@@Z ?start@DwNetworkDetector@@QAE_NXZ ?stop@DwNetworkDetector@@QAEXXZ ?sysLangName@DwI18n@@SA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ ?threadId@DwBusObject@@IBEIXZ ?yyLangName@DwI18n@@SA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ ?yyLangNameID@DwI18n@@SAHXZ addEvent addEventWithToken createComInstance insert_name_id newEventStream newEventStreamWithToken query_name query_name_id reportEventStream reportEventStreamWithToken singleEvent

Name

.text

Size

Virtual Size

232KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

109KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vmp0

Size

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE

Name

.vmp2

Size

210KB

Virtual Size

209KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

84e3df6b415ad077cb5bd639e67653c96f1bc7d26b016aae8784b92c34963fb0

kernel32

advapi32

ole32

oleaut32

wininet

generic

Sharing

General

Malware Config

Signatures

File Explorer

84e3df6b415ad077cb5bd639e67653c96f1bc7d26b016aae8784b92c34963fb0

kernel32

advapi32

ole32

oleaut32

wininet

generic