aaca9b9c6a86f1cb93a3bc2dd9c37e03

General

Target
aaca9b9c6a86f1cb93a3bc2dd9c37e03
Size 848KB
Sample231219-1mb8hsdda6
SHA256 61a0f23a5e8482ff486dd7d8aa4d853a50f5b602dcbe371fbbdd4dca475df4f4
MD5 aaca9b9c6a86f1cb93a3bc2dd9c37e03
SHA1 6c251558c96c72a447c62c95dd13c54f25bf154d
SHA512 3cf624c6fbf0f5652a4e7985d3333f0dc50c9c31a48a70252ff3bffbc65296db49e3ee171616b6fab492dbdbb6ea8e1a340b75b995eea0c013e0707b4201be79
SSDEEP 24576:dhTULzlDiH81/+cFwA8UVn0RTRAhcP6TgzTBvp8kMd:dhTULzlDic1/+cWVRccPlfFp8k2
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aaca9b9c6a86f1cb93a3bc2dd9c37e03

File Explorer

aaca9b9c6a86f1cb93a3bc2dd9c37e03

.dll 848KB

aaca9b9c6a86f1cb93a3bc2dd9c37e03

IMPHASH de09ac5c7ffd40d068e01868f96c1f7e
SHA256 61a0f23a5e8482ff486dd7d8aa4d853a50f5b602dcbe371fbbdd4dca475df4f4
MD5 aaca9b9c6a86f1cb93a3bc2dd9c37e03
SHA1 6c251558c96c72a447c62c95dd13c54f25bf154d
SHA512 3cf624c6fbf0f5652a4e7985d3333f0dc50c9c31a48a70252ff3bffbc65296db49e3ee171616b6fab492dbdbb6ea8e1a340b75b995eea0c013e0707b4201be79
SSDEEP 24576:dhTULzlDiH81/+cFwA8UVn0RTRAhcP6TgzTBvp8kMd:dhTULzlDic1/+cWVRccPlfFp8k2
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

1590871

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Name

.text

Size

Virtual Size

491KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

327KB

Virtual Size

326KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

Virtual Size

259KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp1

Size

517KB

Virtual Size

516KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

469B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

aaca9b9c6a86f1cb93a3bc2dd9c37e03

kernel32

user32

advapi32

msvcp140

winmm

imm32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

generic

Sharing

General

Malware Config

Signatures

File Explorer

aaca9b9c6a86f1cb93a3bc2dd9c37e03

kernel32

user32

advapi32

msvcp140

winmm

imm32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

generic