92e46f99fe52fb9e702f9bc5f9b01b18

Sharing

Copy URL Twitter E-mail

General

Target
92e46f99fe52fb9e702f9bc5f9b01b18
Size 1.5MB
Sample231222-p6tfcsedf8
SHA256 6dcf0a6fe86624ff2007b11a9ebf4833462cb4cbf29f7b4051a066dc5d688626
MD5 92e46f99fe52fb9e702f9bc5f9b01b18
SHA1 88100b0d41f054c2a35fe92216c6bd17b2f2f0e5
SHA512 dea8b43a564c1bd1f11da4344b14443b44e9af0c17503141e3cec42bfd6a03dbfbb7838120a4b11631a2b528d171203d593cfc9b9dce1c229864b96eecc99000
SSDEEP 24576:rBHD4TMs86BpUNYMvTMnXtwgzMBr/EKntWktkyJg4yGUqyWI0AVCrN4:NMTMs5pUNYMvTMXZgtt/sl0AVc4
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
static1/unpack001/小白多功能工具箱.exe	vmprotect

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack002/小白多功能工具箱一键修复.exe
unpack001/小白多功能工具箱.exe

File Explorer

92e46f99fe52fb9e702f9bc5f9b01b18

.rar 1.5MB
小白一键修复.rar

.rar 296KB
小白多功能工具箱一键修复.exe

.exe 696KB
小白多功能工具箱.exe

.exe 1.2MB

92e46f99fe52fb9e702f9bc5f9b01b18

SHA256 6dcf0a6fe86624ff2007b11a9ebf4833462cb4cbf29f7b4051a066dc5d688626
MD5 92e46f99fe52fb9e702f9bc5f9b01b18
SHA1 88100b0d41f054c2a35fe92216c6bd17b2f2f0e5
SHA512 dea8b43a564c1bd1f11da4344b14443b44e9af0c17503141e3cec42bfd6a03dbfbb7838120a4b11631a2b528d171203d593cfc9b9dce1c229864b96eecc99000
SSDEEP 24576:rBHD4TMs86BpUNYMvTMnXtwgzMBr/EKntWktkyJg4yGUqyWI0AVCrN4:NMTMs5pUNYMvTMXZgtt/sl0AVc4
MD5 SHA1 SHA512 SSDEEP

小白多功能工具箱一键修复.exe

IMPHASH 38bad84454da1b96470afaeda40682dd
SHA256 b665d6cb1351a4289643466cb009805073dc83d02a350c826707e21d71fa83b4
MD5 469b1d27684059d4ec473f917f12e65c
SHA1 f27e545a22b451b41bc660ad0df47ae85d536794
SHA512 213c04eeac156fe09a8dc55ea7d398194ddcbafc6510f65831083f34c4ba6a207caa9c89c28a921d9e8b1d03a99cabbd58d56397d1b9bbbff83307972fe0da17
SSDEEP 12288:pz9WeBneuUGNG/MC86kdOlEQbKKeqbJBLBkAZfz68:pzYYnRUIGC6sQEQbNbPZfzn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

391063

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer GetCurrentProcess DuplicateHandle lstrcpynA SetLastError FileTimeToLocalFileTime FileTimeToSystemTime LocalFree MultiByteToWideChar WideCharToMultiByte InterlockedDecrement CreateSemaphoreA ResumeThread ReleaseSemaphore SetStdHandle IsBadCodePtr IsBadReadPtr CompareStringW CompareStringA SetUnhandledExceptionFilter GetStringTypeW GetStringTypeA IsBadWritePtr VirtualAlloc LCMapStringW LCMapStringA SetEnvironmentVariableA VirtualFree HeapCreate HeapDestroy GetEnvironmentVariableA GetFileType GetStdHandle SetHandleCount GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW FreeEnvironmentStringsA UnhandledExceptionFilter GetACP HeapSize EnterCriticalSection LeaveCriticalSection GetProfileStringA WriteFile ReadFile GetLastError WaitForMultipleObjects CreateFileA SetEvent FindResourceA LoadResource LockResource GetModuleFileNameA GetCurrentThreadId ExitProcess GlobalSize GlobalFree DeleteCriticalSection InitializeCriticalSection lstrcatA lstrlenA WinExec lstrcpyA FindNextFileA GlobalReAlloc HeapFree HeapReAlloc GetProcessHeap HeapAlloc GetFullPathNameA FreeLibrary LoadLibraryA GetVersionExA WritePrivateProfileStringA CreateThread CreateEventA Sleep GlobalAlloc GlobalLock GlobalUnlock FindFirstFileA FindClose GetFileAttributesA TerminateProcess GetLocalTime GetSystemTime GetTimeZoneInformation RaiseException RtlUnwind GetStartupInfoA GetOEMCP GetCPInfo GetProcessVersion SetErrorMode GlobalFlags GetCurrentThread GetFileTime GetFileSize TlsGetValue LocalReAlloc TlsSetValue TlsFree GlobalHandle TlsAlloc LocalAlloc SetCurrentDirectoryA GetVolumeInformationA GetModuleHandleA GetProcAddress lstrcmpA GetVersion GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom lstrcmpiA MulDiv GetCommandLineA GetTickCount WaitForSingleObject CloseHandle InterlockedIncrement

user32

OpenClipboard SetClipboardData EmptyClipboard GetSystemMetrics GetCursorPos MessageBoxA SetWindowPos SendMessageA DestroyCursor SetParent GetClipboardData PostMessageA GetTopWindow GetParent GetFocus GetClientRect InvalidateRect ValidateRect UpdateWindow CloseClipboard wsprintfA EqualRect GetWindowRect SetForegroundWindow IsWindow DestroyMenu IsChild ReleaseDC IsRectEmpty FillRect GetDC SetCursor LoadCursorA SetCursorPos SetActiveWindow GetSysColor SetWindowLongA GetWindowLongA RedrawWindow EnableWindow IsWindowVisible OffsetRect PtInRect DestroyIcon IntersectRect InflateRect SetRect SetScrollPos SetScrollRange GetScrollRange SetCapture GetCapture ReleaseCapture LoadIconA TranslateMessage DrawFrameControl DrawEdge DrawFocusRect WindowFromPoint GetMessageA DispatchMessageA SetRectEmpty RegisterClipboardFormatA CreateIconFromResourceEx CreateIconFromResource DrawIconEx CreatePopupMenu AppendMenuA ModifyMenuA CreateMenu CreateAcceleratorTableA GetDlgCtrlID GetSubMenu EnableMenuItem ClientToScreen EnumDisplaySettingsA LoadImageA SystemParametersInfoA ShowWindow IsWindowEnabled TranslateAcceleratorA GetKeyState CopyAcceleratorTableA PostQuitMessage IsZoomed GetClassInfoA GetWindowTextA GetWindowTextLengthA CharUpperA GetWindowDC BeginPaint EndPaint TabbedTextOutA DrawTextA GrayStringA GetDlgItem DestroyWindow CreateDialogIndirectParamA EndDialog GetNextDlgTabItem GetWindowPlacement RegisterWindowMessageA GetForegroundWindow GetLastActivePopup GetMessageTime RemovePropA CallWindowProcA GetPropA UnhookWindowsHookEx SetPropA GetClassLongA CallNextHookEx SetWindowsHookExA CreateWindowExA GetMenuItemID GetMenuItemCount RegisterClassA GetScrollPos UnregisterClassA AdjustWindowRectEx MapWindowPoints SendDlgItemMessageA ScrollWindowEx IsDialogMessageA SetWindowTextA MoveWindow CheckMenuItem SetMenuItemBitmaps GetMenuState GetMenuCheckMarkDimensions GetClassNameA GetDesktopWindow LoadStringA GetSysColorBrush DefWindowProcA GetSystemMenu DeleteMenu GetMenu SetMenu PeekMessageA IsIconic SetFocus GetActiveWindow GetWindow DestroyAcceleratorTable SetWindowRgn GetMessagePos ScreenToClient ChildWindowFromPointEx CopyRect LoadBitmapA WinHelpA KillTimer SetTimer

gdi32

GetClipRgn CreatePolygonRgn SelectClipRgn DeleteObject CreateDIBitmap GetSystemPaletteEntries CreatePalette StretchBlt SelectPalette RealizePalette GetDIBits GetWindowExtEx GetViewportOrgEx GetWindowOrgEx BeginPath EndPath PathToRegion CreateEllipticRgn CreateRoundRectRgn GetTextColor GetBkMode GetBkColor GetROP2 GetStretchBltMode GetPolyFillMode CreateCompatibleBitmap CreateDCA CreateBitmap SelectObject GetObjectA CreatePen PatBlt CombineRgn SetStretchBltMode FillRgn CreateSolidBrush GetStockObject CreateFontIndirectA EndPage EndDoc DeleteDC StartDocA StartPage BitBlt CreateCompatibleDC Ellipse Rectangle LPtoDP DPtoLP GetCurrentObject RoundRect GetTextExtentPoint32A GetDeviceCaps SaveDC RestoreDC SetBkMode SetPolyFillMode SetROP2 SetTextColor SetMapMode SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx SetWindowExtEx ScaleWindowExtEx GetClipBox ExcludeClipRect MoveToEx LineTo CreateRectRgnIndirect SetBkColor CreateRectRgn GetTextMetricsA Escape ExtTextOutA TextOutA RectVisible PtVisible GetViewportExtEx ExtSelectClipRgn

winmm

midiStreamRestart midiStreamClose midiOutReset midiStreamStop midiStreamOut midiOutPrepareHeader midiStreamProperty midiStreamOpen midiOutUnprepareHeader waveOutOpen waveOutGetNumDevs waveOutClose waveOutReset waveOutPause waveOutWrite waveOutPrepareHeader waveOutUnprepareHeader

winspool.drv

ClosePrinter DocumentPropertiesA OpenPrinterA

advapi32

RegCloseKey RegOpenKeyExA RegSetValueExA RegQueryValueA RegCreateKeyExA

shell32

ShellExecuteA Shell_NotifyIconA

ole32

OleUninitialize CLSIDFromString OleInitialize

oleaut32

UnRegisterTypeLi RegisterTypeLi LoadTypeLi

comctl32

ImageList_Destroy ord17

ws2_32

ioctlsocket recv getpeername accept recvfrom WSAAsyncSelect closesocket WSACleanup inet_ntoa

comdlg32

GetFileTitleA GetSaveFileNameA GetOpenFileNameA ChooseColorA

小白多功能工具箱.exe

IMPHASH 4c899f57a138e977cbc754c753fc5c32
SHA256 e0416e1e00dd698149e05b286a8b77d269178db3e19e10239fea5e96d680c414
MD5 0e2812a484497f785c6e3ad51501e2d2
SHA1 c138fab95f6e75e85031ed2958d944045884934b
SHA512 81c1f1679c000e954d14633cbc3e70a692dce78e5b602c22e7952dd563ddc96aa2da778607f319c931c9c1cb8ddab49c3eda095a5a90f6405ba0193a1be686b8
SSDEEP 24576:XqsLsnZaPJ2YeOQFcSJlYXK2+dvsGDHLySOayRUC0TK+7j1/Uy:X/LsnAPJ7eOQFcSJlYYDry+C0TK+1s
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2878106

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

Virtual Size

500KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

154KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

Virtual Size

908KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp1

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

92e46f99fe52fb9e702f9bc5f9b01b18

小白一键修复.rar

小白多功能工具箱一键修复.exe

kernel32

user32

gdi32

winmm

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

ws2_32

comdlg32

generic

小白多功能工具箱.exe

kernel32

user32

gdi32

winmm

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

ws2_32

comdlg32

generic