633c69b00d71bec0c918b73938434b95

Sharing

Copy URL Twitter E-mail

General

Target
633c69b00d71bec0c918b73938434b95
Size 2.6MB
Sample231222-ezxt4afbh7
SHA256 cfad85836104b5a1d7a52c99630852c33b73e0636da44ee24b2665d7312fe286
MD5 633c69b00d71bec0c918b73938434b95
SHA1 36f60e90479d7676a0fa8c85cdb8a8eba1bfbbe2
SHA512 bab8df963a6536b0c21e1976f0bf1e6e6347047d63a55dbf17afcf89945b9427aa705c058ded307bc919b80725a75cb909ba9784a77337680783d9e0d448e129
SSDEEP 49152:bzddGlxemn3EOrLbizKFtIuevdlB3rGqn955+8kGSbjUZmHHETyw:3gQZOrXFIvvdloqnF+bvbz
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
633c69b00d71bec0c918b73938434b95

File Explorer

633c69b00d71bec0c918b73938434b95

.exe 2.6MB

633c69b00d71bec0c918b73938434b95

IMPHASH adfc1924ae09065e8f88c1fc39725c50
SHA256 cfad85836104b5a1d7a52c99630852c33b73e0636da44ee24b2665d7312fe286
MD5 633c69b00d71bec0c918b73938434b95
SHA1 36f60e90479d7676a0fa8c85cdb8a8eba1bfbbe2
SHA512 bab8df963a6536b0c21e1976f0bf1e6e6347047d63a55dbf17afcf89945b9427aa705c058ded307bc919b80725a75cb909ba9784a77337680783d9e0d448e129
SSDEEP 49152:bzddGlxemn3EOrLbizKFtIuevdlB3rGqn955+8kGSbjUZmHHETyw:3gQZOrXFIvvdloqnF+bvbz
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5199183

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetTickCount64 GetCurrentProcess LocalAlloc GetCurrentProcess GetCurrentThread LocalFree GetModuleFileNameW GetProcessAffinityMask SetProcessAffinityMask SetThreadAffinityMask Sleep ExitProcess GetLastError FreeLibrary LoadLibraryA GetModuleHandleA GetProcAddress

user32

GetAsyncKeyState CharUpperBuffW

advapi32

CryptAcquireContextA RegQueryValueExA OpenSCManagerW EnumServicesStatusExW OpenServiceW QueryServiceConfigW CloseServiceHandle

msvcp140

?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ

shlwapi

SHDeleteKeyW

wininet

HttpSendRequestA

vcruntime140

memcmp

api-ms-win-crt-runtime-l1-1-0

_get_initial_narrow_environment

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func

api-ms-win-crt-heap-l1-1-0

malloc

api-ms-win-crt-utility-l1-1-0

srand

api-ms-win-crt-string-l1-1-0

_stricmp

api-ms-win-crt-filesystem-l1-1-0

_unlock_file

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

wtsapi32

WTSSendMessageW

Name

.text

Size

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

29KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vmp0

Size

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

633c69b00d71bec0c918b73938434b95

kernel32

user32

advapi32

msvcp140

shlwapi

wininet

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

wtsapi32

generic