014653d6b17f29083cbb62debb2993fc

General

Target
014653d6b17f29083cbb62debb2993fc
Size 8.6MB
Sample231224-rxnvmafffk
SHA256 c8a40e8a075c7702f16de499dadbe7a8f437579eef39cf980835d111c8cdf173
MD5 014653d6b17f29083cbb62debb2993fc
SHA1 710416458c5c0e75aa3d836d64d1f4da5f20b2c2
SHA512 3ecedcfa701541c3fd09f272863a11b39f7217fac86fd5d7b58340bba6fed31fac6bf763173a20cc1dff851d4f448dbadc1e04b26d84a70d833b31dd4468e48e
SSDEEP 196608:pyq4a9r9hPj5hKAeLykkEU7wiMPnH/ELax32OGgVVPqLp29Bn:pyqF15haLyjEU7wzPld2ePqc
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

File Explorer

014653d6b17f29083cbb62debb2993fc

.exe 8.6MB

014653d6b17f29083cbb62debb2993fc

IMPHASH b28bc27be819d66dc93953b481d67436
SHA256 c8a40e8a075c7702f16de499dadbe7a8f437579eef39cf980835d111c8cdf173
MD5 014653d6b17f29083cbb62debb2993fc
SHA1 710416458c5c0e75aa3d836d64d1f4da5f20b2c2
SHA512 3ecedcfa701541c3fd09f272863a11b39f7217fac86fd5d7b58340bba6fed31fac6bf763173a20cc1dff851d4f448dbadc1e04b26d84a70d833b31dd4468e48e
SSDEEP 196608:pyq4a9r9hPj5hKAeLykkEU7wiMPnH/ELax32OGgVVPqLp29Bn:pyqF15haLyjEU7wzPld2ePqc
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect

PE Signature issue

Digest

37:e9:d2:5b:ab:1d:19:58:6d:08:66:eb:53:b8:b1:da:d9:a2:39:4d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Child

Chains

Jul 27, 2021

Subject

CN=Root

Serial Number

06:d3:a9:88:78:f4:b9:42:b2:33:0e:e3:94:fc:de:46

Issuer

CN=Root

Timespan

Jun 17, 2021 - Dec 31, 2039

Subject

CN=Child

Serial Number

1e:27:ac:ad:3d:f0:06:5f:b2:00:88:d6:cd:54:e9:e8

Issuer

CN=Root

Timespan

Jun 17, 2021 - Dec 31, 2039

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

0

Major OS version

5

Entry point

18687821

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

Virtual Size

946KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

545KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

Virtual Size

5.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp1

Size

8.6MB

Virtual Size

8.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

014653d6b17f29083cbb62debb2993fc

PE Signature issue

kernel32

user32

advapi32

ws2_32

ole32

oleaut32

msvfw32

avifil32

winmm

gdi32

winspool.drv

comdlg32

shell32

comctl32

generic

Sharing

General

Malware Config

Signatures

File Explorer

014653d6b17f29083cbb62debb2993fc

PE Signature issue

kernel32

user32

advapi32

ws2_32

ole32

oleaut32

msvfw32

avifil32

winmm

gdi32

winspool.drv

comdlg32

shell32

comctl32

generic