11504971bb85cdacb8ef7d45e6e2aeb7

Sharing

Copy URL Twitter E-mail

General

Target
11504971bb85cdacb8ef7d45e6e2aeb7
Size 88KB
Sample231221-rfk3eahdhl
SHA256 ca87326771eff77b636bcd3855822332c319a656f06e996940947a307262db4f
MD5 11504971bb85cdacb8ef7d45e6e2aeb7
SHA1 53be0518357b99231676e5ddda574fae8f899827
SHA512 9ae5f5bc3e2f9ee7b152aa9f3818b1c39a64bf256bd11c5329cd460ab37aa07a5c626514723872c688369e8b5def8dd376c7ebb9baafc5ee3f04814ef896df88
SSDEEP 1536:zCktRBB3sRNDLhluCOc1cC/S21edLUXa08WBkip6Du3BXjs/EiO5xPjc:ektRnsRtLhluk1cC/S21sbWBkFGzssio
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
11504971bb85cdacb8ef7d45e6e2aeb7

File Explorer

11504971bb85cdacb8ef7d45e6e2aeb7

.exe 88KB

11504971bb85cdacb8ef7d45e6e2aeb7

IMPHASH 2fc6db892e59820855bc4e41ddb3300c
SHA256 ca87326771eff77b636bcd3855822332c319a656f06e996940947a307262db4f
MD5 11504971bb85cdacb8ef7d45e6e2aeb7
SHA1 53be0518357b99231676e5ddda574fae8f899827
SHA512 9ae5f5bc3e2f9ee7b152aa9f3818b1c39a64bf256bd11c5329cd460ab37aa07a5c626514723872c688369e8b5def8dd376c7ebb9baafc5ee3f04814ef896df88
SSDEEP 1536:zCktRBB3sRNDLhluCOc1cC/S21edLUXa08WBkip6Du3BXjs/EiO5xPjc:ektRnsRtLhluk1cC/S21sbWBkFGzssio
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

154180

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CloseHandle TerminateProcess WriteFile CreateThread CreateProcessA MultiByteToWideChar CreatePipe ReadFile GetLastError GetShortPathNameA WideCharToMultiByte GetModuleFileNameA GetStartupInfoA Sleep LoadLibraryA GetProcAddress SetEnvironmentVariableA CompareStringW CompareStringA LCMapStringW LCMapStringA CreateFileA FlushFileBuffers SetStdHandle GetStringTypeW GetStringTypeA IsBadCodePtr IsBadReadPtr SetUnhandledExceptionFilter IsBadWritePtr VirtualAlloc RtlUnwind GetTimeZoneInformation GetSystemTime GetLocalTime ExitProcess GetCurrentProcess GetCommandLineA GetVersion HeapFree RaiseException HeapAlloc GetCPInfo GetACP GetOEMCP SetFilePointer HeapReAlloc HeapSize UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStdHandle GetFileType GetModuleHandleA GetEnvironmentVariableA GetVersionExA HeapDestroy HeapCreate VirtualFree SetEndOfFile VirtualProtect GetModuleFileNameA ExitProcess

advapi32

RegCloseKey RegSetValueExA RegCreateKeyExA

wininet

InternetCloseHandle InternetReadFile HttpOpenRequestW InternetCrackUrlW InternetSetOptionW InternetOpenW InternetConnectW HttpAddRequestHeadersW InternetSetCookieW HttpSendRequestExW InternetWriteFile HttpEndRequestA HttpQueryInfoW InternetQueryDataAvailable

ws2_32

WSAStartup gethostname

user32

MessageBoxA

Name

.text

Size

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

80KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

52B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

11504971bb85cdacb8ef7d45e6e2aeb7

kernel32

advapi32

wininet

ws2_32

user32

generic