764757a73a1323a97d401130d4b39c3b

General

Target
764757a73a1323a97d401130d4b39c3b
Size 464KB
Sample240126-d424yaddb3
SHA256 bf72b83163bcdc54ac0aa0817449a24a8927bbaf6131a97a4ffd8c8c3bbff72b
MD5 764757a73a1323a97d401130d4b39c3b
SHA1 259d50e05697dddf2745d807539041a99f99f413
SHA512 c3e85ec7d039efdee4b6c81b96a4c1d2bc3113170b6612ef2743bf3f0428c790adda4c6c3a0a6ffda5fdcc90114a396fa545b560b1fe94870affc97bdec2e3b1
SSDEEP 12288:1CbijkT2W4z1srO15D8hDGU2dOJVNv/Hyq87Tb0:lkT2H15D8NGRd+VN3HGTb
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
764757a73a1323a97d401130d4b39c3b

File Explorer

764757a73a1323a97d401130d4b39c3b

.exe 464KB

764757a73a1323a97d401130d4b39c3b

IMPHASH ee46806ac684468f426a5ffa3597cea4
SHA256 bf72b83163bcdc54ac0aa0817449a24a8927bbaf6131a97a4ffd8c8c3bbff72b
MD5 764757a73a1323a97d401130d4b39c3b
SHA1 259d50e05697dddf2745d807539041a99f99f413
SHA512 c3e85ec7d039efdee4b6c81b96a4c1d2bc3113170b6612ef2743bf3f0428c790adda4c6c3a0a6ffda5fdcc90114a396fa545b560b1fe94870affc97bdec2e3b1
SSDEEP 12288:1CbijkT2W4z1srO15D8hDGU2dOJVNv/Hyq87Tb0:lkT2H15D8NGRd+VN3HGTb
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

1255737

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ws2_32

__WSAFDIsSet getsockopt ioctlsocket select recv send WSACleanup WSAStartup inet_ntoa closesocket connect socket htons WSAGetLastError inet_addr

kernel32

SizeofResource Sleep CreateMutexA GetLastError GetModuleFileNameA lstrlenA SetEvent GetTickCount lstrcpyA GetExitCodeThread CreateEventA ResetEvent CreateThread WaitForSingleObject CloseHandle WaitForMultipleObjects TerminateThread GetSystemTimeAsFileTime RtlMoveMemory GetCurrentThreadId GetProcAddress GetVersion GetFileType GetStdHandle QueryPerformanceCounter GetCurrentProcessId GlobalMemoryStatus FreeLibrary LoadLibraryA GetVersionExA FlushConsoleInputBuffer GetStringTypeW GetStringTypeA CreateFileA LockResource LoadResource GlobalFree GlobalAlloc GetModuleHandleA FindResourceA GetLocaleInfoA WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileW CompareStringA CompareStringW SetEnvironmentVariableA MultiByteToWideChar SetEndOfFile LCMapStringW LCMapStringA InitializeCriticalSection SetStdHandle FlushFileBuffers GetConsoleCP GetCommandLineA HeapFree HeapAlloc GetProcessHeap GetStartupInfoA HeapReAlloc EnterCriticalSection LeaveCriticalSection ExitProcess SetConsoleCtrlHandler ReadConsoleInputA SetConsoleMode GetConsoleMode TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent WriteFile FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount DeleteCriticalSection TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement HeapDestroy HeapCreate VirtualFree VirtualAlloc HeapSize GetCPInfo GetACP GetOEMCP IsValidCodePage ReadFile SetFilePointer RtlUnwind GetModuleFileNameW GetModuleHandleA LoadLibraryA LocalAlloc LocalFree GetModuleFileNameA ExitProcess

user32

GetProcessWindowStation GetDesktopWindow MessageBoxA GetUserObjectInformationW

advapi32

ReportEventA DeregisterEventSource RegCloseKey RegSetValueExA RegDeleteValueA RegOpenKeyExA RegisterEventSourceA

libssh2_banner_set libssh2_base64_decode libssh2_channel_close libssh2_channel_direct_tcpip_ex libssh2_channel_eof libssh2_channel_flush_ex libssh2_channel_forward_accept libssh2_channel_forward_cancel libssh2_channel_forward_listen_ex libssh2_channel_free libssh2_channel_get_exit_signal libssh2_channel_get_exit_status libssh2_channel_handle_extended_data libssh2_channel_handle_extended_data2 libssh2_channel_open_ex libssh2_channel_process_startup libssh2_channel_read_ex libssh2_channel_receive_window_adjust libssh2_channel_receive_window_adjust2 libssh2_channel_request_pty_ex libssh2_channel_request_pty_size_ex libssh2_channel_send_eof libssh2_channel_set_blocking libssh2_channel_setenv_ex libssh2_channel_wait_closed libssh2_channel_wait_eof libssh2_channel_window_read_ex libssh2_channel_window_write_ex libssh2_channel_write_ex libssh2_channel_x11_req_ex libssh2_exit libssh2_free libssh2_hostkey_hash libssh2_init libssh2_keepalive_config libssh2_keepalive_send libssh2_poll libssh2_poll_channel_read libssh2_session_abstract libssh2_session_block_directions libssh2_session_callback_set libssh2_session_disconnect_ex libssh2_session_flag libssh2_session_free libssh2_session_get_blocking libssh2_session_get_timeout libssh2_session_handshake libssh2_session_hostkey libssh2_session_init_ex libssh2_session_last_errno libssh2_session_last_error libssh2_session_method_pref libssh2_session_methods libssh2_session_set_blocking libssh2_session_set_timeout libssh2_session_startup libssh2_sftp_close_handle libssh2_sftp_fstat_ex libssh2_sftp_fstatvfs libssh2_sftp_init libssh2_sftp_last_error libssh2_sftp_mkdir_ex libssh2_sftp_open_ex libssh2_sftp_read libssh2_sftp_readdir_ex libssh2_sftp_rename_ex libssh2_sftp_rmdir_ex libssh2_sftp_seek libssh2_sftp_seek64 libssh2_sftp_shutdown libssh2_sftp_stat_ex libssh2_sftp_statvfs libssh2_sftp_symlink_ex libssh2_sftp_tell libssh2_sftp_tell64 libssh2_sftp_unlink_ex libssh2_sftp_write libssh2_trace libssh2_trace_sethandler libssh2_userauth_authenticated libssh2_userauth_hostbased_fromfile_ex libssh2_userauth_keyboard_interactive_ex libssh2_userauth_list libssh2_userauth_password_ex libssh2_userauth_publickey libssh2_userauth_publickey_fromfile_ex

Name

.text

Size

Virtual Size

599KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

186KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

89KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vmp0

Size

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

456KB

Virtual Size

452KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

764757a73a1323a97d401130d4b39c3b

ws2_32

kernel32

user32

advapi32

generic