4c3a95b71314ced4b6ddaa2f1f5883daffd7ebb5de37522b3511d1b7f2ede41e

Sharing

Copy URL Twitter E-mail

General

Target
4c3a95b71314ced4b6ddaa2f1f5883daffd7ebb5de37522b3511d1b7f2ede41e
Size 5.9MB
Sample240111-qssscaggdk
SHA256 4c3a95b71314ced4b6ddaa2f1f5883daffd7ebb5de37522b3511d1b7f2ede41e
MD5 8c91eb3be51ceecca875992ad924b894
SHA1 f7879f3e41f534a52d6b26cd50134e972bbe1ba8
SHA512 405623e7bc2a9f294193881c5129d1514604fbd4f163b2d60cc23dc16fa3e6b80f36368e36086d72dfcbfa3955c28c8515ad11b011432c91d2a2a4e59c279528
SSDEEP 98304:FSeF5AizUG39fAicF8QLTq9C8HgJJYmbiE+xWSc7apNxZWb1Drj3JmizxW67x:FzF5doG39fFmLTWq+sSc7apN29jIcxP
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4c3a95b71314ced4b6ddaa2f1f5883daffd7ebb5de37522b3511d1b7f2ede41e

File Explorer

4c3a95b71314ced4b6ddaa2f1f5883daffd7ebb5de37522b3511d1b7f2ede41e

.exe 5.9MB

4c3a95b71314ced4b6ddaa2f1f5883daffd7ebb5de37522b3511d1b7f2ede41e

IMPHASH 3a2f2afdde831bef5ab366db8e8b44f6
SHA256 4c3a95b71314ced4b6ddaa2f1f5883daffd7ebb5de37522b3511d1b7f2ede41e
MD5 8c91eb3be51ceecca875992ad924b894
SHA1 f7879f3e41f534a52d6b26cd50134e972bbe1ba8
SHA512 405623e7bc2a9f294193881c5129d1514604fbd4f163b2d60cc23dc16fa3e6b80f36368e36086d72dfcbfa3955c28c8515ad11b011432c91d2a2a4e59c279528
SSDEEP 98304:FSeF5AizUG39fAicF8QLTq9C8HgJJYmbiE+xWSc7apNxZWb1Drj3JmizxW67x:FzF5doG39fFmLTWq+sSc7apN29jIcxP
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5131239

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winmm

PlaySoundW

kernel32

CreateDirectoryW GetSystemTimeAsFileTime LocalAlloc LocalFree GetModuleFileNameW GetProcessAffinityMask SetProcessAffinityMask SetThreadAffinityMask Sleep ExitProcess FreeLibrary LoadLibraryA GetModuleHandleA GetProcAddress

user32

SetForegroundWindow GetUserObjectInformationW GetProcessWindowStation GetUserObjectInformationW

shell32

SHGetFolderPathW

msvcp140

?_Xinvalid_argument@std@@YAXPEBD@Z

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

ntdll

RtlVirtualUnwind

imm32

ImmSetCandidateWindow

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memset

api-ms-win-crt-heap-l1-1-0

free

api-ms-win-crt-runtime-l1-1-0

__p___argv

api-ms-win-crt-stdio-l1-1-0

_get_stream_buffer_pointers

api-ms-win-crt-string-l1-1-0

strncpy

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-filesystem-l1-1-0

_unlock_file

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func

api-ms-win-crt-math-l1-1-0

acosf

wtsapi32

WTSSendMessageW

Name

.text

Size

Virtual Size

622KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

346KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vmp0

Size

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

5.7MB

Virtual Size

5.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

200B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

241KB

Virtual Size

241KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

4c3a95b71314ced4b6ddaa2f1f5883daffd7ebb5de37522b3511d1b7f2ede41e

winmm

kernel32

user32

shell32

msvcp140

d3d11

d3dcompiler_47

dwmapi

ntdll

imm32

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

wtsapi32

generic