0445ef47c300f405ab851bd541c0dbba

General

Target
0445ef47c300f405ab851bd541c0dbba
Size 86KB
Sample231224-s8nvfafbgp
SHA256 06e41567bfedee7a9de1d2aee83f9a2d380e3cac368c130a1a37caa2b052e937
MD5 0445ef47c300f405ab851bd541c0dbba
SHA1 c7ab3f53ec57754cbcf5973f333f48524e231d6f
SHA512 e1cbdc7d9b5bbb40d56761b2f755806dcacecfa90e6afa8727eaeb85a5ae24c77334a2a9fcb0b1db7dcb2612cc22d6c227412eb0898fcbf695f5803c9d20d435
SSDEEP 1536:oMJmWKNEo2mN86MowNdcsL8iNVbGtU+EjR3DUsSLWFekzJIvMXCWA9634SIefsRj:oMJmWKNgAJwrzoGctULR3DfylkKst4SW
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0445ef47c300f405ab851bd541c0dbba

File Explorer

0445ef47c300f405ab851bd541c0dbba

.dll 86KB

0445ef47c300f405ab851bd541c0dbba

IMPHASH fedb7da80dcf0d5ae319f312fdafa740
SHA256 06e41567bfedee7a9de1d2aee83f9a2d380e3cac368c130a1a37caa2b052e937
MD5 0445ef47c300f405ab851bd541c0dbba
SHA1 c7ab3f53ec57754cbcf5973f333f48524e231d6f
SHA512 e1cbdc7d9b5bbb40d56761b2f755806dcacecfa90e6afa8727eaeb85a5ae24c77334a2a9fcb0b1db7dcb2612cc22d6c227412eb0898fcbf695f5803c9d20d435
SSDEEP 1536:oMJmWKNEo2mN86MowNdcsL8iNVbGtU+EjR3DUsSLWFekzJIvMXCWA9634SIefsRj:oMJmWKNgAJwrzoGctULR3DfylkKst4SW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

21307

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetModuleFileNameA WritePrivateProfileStringA GetWindowsDirectoryA IsBadStringPtrW Module32Next Module32First CreateToolhelp32Snapshot DeleteFileA GetTempPathA CreateFileMappingA GetFileAttributesW ReadProcessMemory VirtualQueryEx WideCharToMultiByte GetPrivateProfileStringA GetFileSize CreateFileA GetModuleHandleA CreateThread SetFilePointer HeapAlloc GetProcessHeap OutputDebugStringA OpenProcess TerminateProcess GetCurrentProcess Sleep GetCurrentThreadId OpenFileMappingA MapViewOfFile UnmapViewOfFile CloseHandle GetProcAddress LoadLibraryA ReadFile FreeLibrary

user32

GetWindowThreadProcessId GetDC GetWindowRect wvsprintfA GetClassNameW wsprintfA GetKeyboardState ToAscii SendMessageA AttachThreadInput GetFocus FindWindowA GetWindow

wininet

DeleteUrlCacheEntry

urlmon

URLDownloadToFileA

gdi32

DeleteDC DeleteObject BitBlt SelectObject CreateCompatibleBitmap CreateCompatibleDC GetDeviceCaps CreateDCA

msvcrt

wcsncat wcscpy wcsstr exit printf wcslen time srand rand malloc _stricmp tolower _vsnprintf _ltoa _strupr _strcmpi ??3@YAXPAX@Z wcscmp ??2@YAPAXI@Z fclose ftell fseek fopen mbstowcs _except_handler3 strlen strcpy memset memcpy free strncpy sprintf strrchr strstr

Name

.text

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

0445ef47c300f405ab851bd541c0dbba

kernel32

user32

wininet

urlmon

gdi32

msvcrt

generic