file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 3.0MB
Sample240111-n1qa3sfcdj
SHA256 0b5a6b652547d225e983046733875ca231e167766c9944e5c35a50ffdcc5a2a3
MD5 2f4dbdd2ed2c56e633f8eb47687a431e
SHA1 ac0bd16a68f34f8c2ece7917c5e958199c6b7076
SHA512 d06fb7b615ec96ce9cb692b8bb5c7efb5d6c4430bd0fa41428636846d5755d9954b41d5f40ce607efd7ccb4b1a4e9c2c8eb6eff4f688dada4ed5387905e71fa5
SSDEEP 49152:NAPZ/ttZvtIeeqwK8yiQItSfcLuSjSfslOQwkNcP1ArlKHcMV1yuI20CMgKNVIZk:NAPZ1tNtIeeqb8yk22jKQwk2dArxMj0l
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 3.0MB

file.exe

IMPHASH 8c64ee2e7a0f1643c7af909f5af41768
SHA256 0b5a6b652547d225e983046733875ca231e167766c9944e5c35a50ffdcc5a2a3
MD5 2f4dbdd2ed2c56e633f8eb47687a431e
SHA1 ac0bd16a68f34f8c2ece7917c5e958199c6b7076
SHA512 d06fb7b615ec96ce9cb692b8bb5c7efb5d6c4430bd0fa41428636846d5755d9954b41d5f40ce607efd7ccb4b1a4e9c2c8eb6eff4f688dada4ed5387905e71fa5
SSDEEP 49152:NAPZ/ttZvtIeeqwK8yiQItSfcLuSjSfslOQwkNcP1ArlKHcMV1yuI20CMgKNVIZk:NAPZ1tNtIeeqb8yk22jKQwk2dArxMj0l
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5312491

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetVolumeInformationA WaitForSingleObject LocalAlloc GetCurrentThreadId GetModuleHandleA GetLocaleInfoA OpenProcess CreateToolhelp32Snapshot MultiByteToWideChar Sleep GetTempPathA GetModuleHandleExA GetTimeZoneInformation GetTickCount64 CopyFileA GetLastError GetFileAttributesA TzSpecificLocalTimeToSystemTime CreateFileA SetEvent TerminateThread LoadLibraryA GetVersionExA DeleteFileA Process32Next CloseHandle GetSystemInfo CreateThread ResetEvent GetWindowsDirectoryA HeapAlloc SetFileAttributesA GetLocalTime GetProcAddress VirtualAllocEx LocalFree IsProcessorFeaturePresent GetFileSize RemoveDirectoryA ReadProcessMemory GetCurrentProcessId GetProcessHeap GlobalMemoryStatusEx FreeLibrary WideCharToMultiByte CreateRemoteThread CreateDirectoryA GetSystemTime CreateMutexA CreateEventA GetPrivateProfileStringA IsWow64Process IsDebuggerPresent VirtualQueryEx GetComputerNameA SetUnhandledExceptionFilter GetUserDefaultLocaleName lstrcpynA SetFilePointer CreateFileW AreFileApisANSI EnterCriticalSection GetFullPathNameW GetDiskFreeSpaceW LockFile LeaveCriticalSection InitializeCriticalSection GetFullPathNameA SetEndOfFile GetTempPathW GetFileAttributesW FormatMessageW GetDiskFreeSpaceA DeleteFileW UnlockFile LockFileEx DeleteCriticalSection GetSystemTimeAsFileTime FormatMessageA QueryPerformanceCounter GetTickCount FlushFileBuffers HeapSize SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage SetStdHandle HeapReAlloc FindClose lstrlenA InitializeCriticalSectionEx FindNextFileA TerminateProcess OutputDebugStringA WriteFile GetCurrentProcess HeapFree FindFirstFileA WriteProcessMemory Process32First GetPrivateProfileSectionNamesA GetModuleFileNameA WriteConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetFileSizeEx GetConsoleOutputCP ReadConsoleW GetConsoleMode GetStdHandle GetModuleFileNameW GetModuleHandleExW ExitProcess GetFileType SetFilePointerEx LoadLibraryExW ReadFile TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RaiseException RtlUnwind InitializeSListHead GetStartupInfoW UnhandledExceptionFilter GetStringTypeW FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFinalPathNameByHandleW GetModuleHandleW GetFileInformationByHandleEx GetLocaleInfoEx InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive LCMapStringEx EncodePointer DecodePointer CompareStringEx GetCPInfo HeapAlloc HeapFree ExitProcess LoadLibraryA GetModuleHandleA GetProcAddress

user32

wsprintfA GetSystemMetrics GetDesktopWindow GetWindowRect EnumDisplayDevicesA ReleaseDC GetDC GetKeyboardLayoutList GetCursorPos CharNextA

gdi32

CreateCompatibleBitmap SelectObject CreateCompatibleDC DeleteObject BitBlt

advapi32

CredEnumerateA RegOpenKeyExA RegEnumKeyA RegCloseKey GetCurrentHwProfileA RegQueryValueExA RegEnumKeyExA RegCreateKeyExA CredFree GetUserNameA RegSetValueExA

shell32

SHGetFolderPathA ShellExecuteA

ole32

CoInitializeEx CoInitialize CoUninitialize CoCreateInstance

ws2_32

shutdown getaddrinfo WSAStartup send socket connect recv freeaddrinfo setsockopt WSAGetLastError WSACleanup closesocket

crypt32

CryptUnprotectData

shlwapi

PathFindExtensionA

gdiplus

GdiplusStartup GdiplusShutdown GdipDisposeImage GdipSaveImageToFile GdipGetImageEncodersSize GdipCreateBitmapFromHBITMAP GdipGetImageEncoders

setupapi

SetupDiGetClassDevsA SetupDiEnumDeviceInfo SetupDiGetDeviceInterfaceDetailA SetupDiEnumDeviceInterfaces

ntdll

RtlUnicodeStringToAnsiString

Name

.text

Size

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

173KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

Virtual Size

993KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp2

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

131KB

Virtual Size

134KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

file.exe

kernel32

user32

gdi32

advapi32

shell32

ole32

ws2_32

crypt32

shlwapi

gdiplus

setupapi

ntdll

generic