7a030147ac5649ea5772e4f3bafe6759[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
7a030147ac5649ea5772e4f3bafe6759.bin
Size 5.7MB
Sample231224-csfacsfhb3
SHA256 85c55d19c00d3924954d05477b6ed7083b1d70677b222f6d5c833edbd732a815
MD5 7a030147ac5649ea5772e4f3bafe6759
SHA1 5e7ac16b3749fd06fe594ad67a376203bfd9e794
SHA512 d477ba1863cfdc7e26756e10c78e3fb9f2eb9013055add6f1f4334c8007fd904a157968ff5e80613d7a6a8604aaca9a9d7a5c1e8e00e87ec71f70c2776bd47ee
SSDEEP 98304:QWbpFq9+sQ+jDBhhkErWplu9vbGPiujpZuCCwzM4QEOICxUJsWsOhglRoi:VbpFS1DfhP4+v6PiujpbC4QEOKJPDyPo
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7a030147ac5649ea5772e4f3bafe6759.bin

File Explorer

7a030147ac5649ea5772e4f3bafe6759.bin

.exe 5.7MB

7a030147ac5649ea5772e4f3bafe6759.bin

IMPHASH 69e57baf9f3d9390d0cb02ef35adb67c
SHA256 85c55d19c00d3924954d05477b6ed7083b1d70677b222f6d5c833edbd732a815
MD5 7a030147ac5649ea5772e4f3bafe6759
SHA1 5e7ac16b3749fd06fe594ad67a376203bfd9e794
SHA512 d477ba1863cfdc7e26756e10c78e3fb9f2eb9013055add6f1f4334c8007fd904a157968ff5e80613d7a6a8604aaca9a9d7a5c1e8e00e87ec71f70c2776bd47ee
SSDEEP 98304:QWbpFq9+sQ+jDBhhkErWplu9vbGPiujpZuCCwzM4QEOICxUJsWsOhglRoi:VbpFS1DfhP4+v6PiujpbC4QEOKJPDyPo
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8730850

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ntdll

NtQuerySystemInformation

kernel32

VirtualAllocEx GetSystemTimeAsFileTime LocalAlloc LocalFree GetModuleFileNameW GetProcessAffinityMask SetProcessAffinityMask SetThreadAffinityMask Sleep ExitProcess FreeLibrary LoadLibraryA GetModuleHandleA GetProcAddress

user32

SetLayeredWindowAttributes GetUserObjectInformationW GetProcessWindowStation GetUserObjectInformationW

gdi32

GetDeviceCaps

advapi32

RegOpenKeyExA

msvcp140

?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z

userenv

DestroyEnvironmentBlock

shlwapi

StrRChrW

imm32

ImmReleaseContext

d3dcompiler_47

D3DCompile

dwmapi

DwmGetColorizationColor

d3d11

D3D11CreateDeviceAndSwapChain

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memchr

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func

api-ms-win-crt-filesystem-l1-1-0

_lock_file

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe

api-ms-win-crt-string-l1-1-0

strncpy

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-heap-l1-1-0

realloc

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-math-l1-1-0

log

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

ws2_32

inet_addr

wtsapi32

WTSSendMessageW

Name

.text

Size

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

641KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vmp0

Size

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

5.7MB

Virtual Size

5.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

232B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

7a030147ac5649ea5772e4f3bafe6759.bin

ntdll

kernel32

user32

gdi32

advapi32

msvcp140

userenv

shlwapi

imm32

d3dcompiler_47

dwmapi

d3d11

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

ws2_32

wtsapi32

generic