017eda9608450c67c41bf014a02de78b

Sharing

Copy URL Twitter E-mail

General

Target
017eda9608450c67c41bf014a02de78b
Size 49KB
Sample231224-rzbm3sgber
SHA256 059c973591257b1dacea7ae4ee03e4056b663bd1ce576374f550cbca33b97f4a
MD5 017eda9608450c67c41bf014a02de78b
SHA1 ab69ea278d8dee739f2e8036ac1ca856c8327989
SHA512 d94b6a90a464ee96b1d1657d580afc75f03f1314aba7da64877da22ca04d71689d7113c1798730aad6ce5ad6f68f6bc12add3879b5e6d966a988fe40a78f1d64
SSDEEP 768:QQzToao3ZqukH0u5A9sntXlQnH/iyCbIED8hn1cGQL+:JVukH0uYUtXCZEQx1cHL+
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
017eda9608450c67c41bf014a02de78b

File Explorer

017eda9608450c67c41bf014a02de78b

.dll 49KB

017eda9608450c67c41bf014a02de78b

IMPHASH d93ce02e65aab131a0b7666fd0534cc9
SHA256 059c973591257b1dacea7ae4ee03e4056b663bd1ce576374f550cbca33b97f4a
MD5 017eda9608450c67c41bf014a02de78b
SHA1 ab69ea278d8dee739f2e8036ac1ca856c8327989
SHA512 d94b6a90a464ee96b1d1657d580afc75f03f1314aba7da64877da22ca04d71689d7113c1798730aad6ce5ad6f68f6bc12add3879b5e6d966a988fe40a78f1d64
SSDEEP 768:QQzToao3ZqukH0u5A9sntXlQnH/iyCbIED8hn1cGQL+:JVukH0uYUtXCZEQx1cHL+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10880

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

strrchr _strlwr ??2@YAPAXI@Z _mbscmp free fclose ??3@YAXPAX@Z fseek fopen fread malloc _stat mbstowcs __CxxFrameHandler strstr sprintf strtol _mbsrchr ??1type_info@@UAE@XZ _onexit __dllonexit _strupr

mfc42

ord4204 ord5683 ord5710 ord858 ord941 ord939 ord537 ord2818 ord389 ord3229 ord690 ord5204 ord1074 ord6881 ord354 ord5186 ord5442 ord1979 ord665 ord6657 ord5356 ord2393 ord1988 ord540 ord860 ord800 ord269 ord826 ord600 ord1578 ord6467 ord1243 ord1176

kernel32

LocalFree LocalAlloc GetFileSize CreateFileMappingA MapViewOfFile UnmapViewOfFile CreateProcessA SetEndOfFile GetShortPathNameA GetTempPathA GetSystemDirectoryA GlobalLock CreateFileA WriteFile GlobalUnlock GlobalFree GlobalAlloc FindFirstFileA FindClose CloseHandle WriteProcessMemory OpenProcess TerminateProcess lstrcpyA CreateThread WritePrivateProfileStringA GetPrivateProfileStringA Sleep GetModuleHandleA DeleteFileA GetCommandLineA GetProcAddress GetModuleFileNameA GetWindowsDirectoryA GetCurrentProcess GetCurrentProcessId MoveFileA GetTempFileNameA LoadLibraryA

user32

GetDesktopWindow ToAscii GetWindowDC GetWindowRect wsprintfA GetKeyboardState MapVirtualKeyA GetActiveWindow GetForegroundWindow ReleaseDC GetDC

gdi32

BitBlt SelectObject DeleteDC CreateCompatibleDC GetDIBits GetObjectA GetStockObject SelectPalette RealizePalette CreateCompatibleBitmap

comdlg32

GetFileTitleA

advapi32

RegSetValueExA RegCloseKey RegCreateKeyExA

shell32

StrCmpNIA StrStrA

msvcp60

?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?_Xlen@std@@YAXXZ ?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

shlwapi

PathFileExistsA

iphlpapi

GetAdaptersInfo

Name

.text

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

017eda9608450c67c41bf014a02de78b

msvcrt

mfc42

kernel32

user32

gdi32

comdlg32

advapi32

shell32

msvcp60

shlwapi

iphlpapi

generic