7fcda6ec8384a5efe2b1b9c603cedf43

General

Target
7fcda6ec8384a5efe2b1b9c603cedf43
Size 96KB
Sample240129-pcjn3aahdk
SHA256 73fc50a03a8753c195cfc120e39eef264d51a6c59bf990467383d9aa2a19fd85
MD5 7fcda6ec8384a5efe2b1b9c603cedf43
SHA1 b6faacb5001da58410f5ffeec54726e1283d0fc9
SHA512 ee359992e595374ff7fc8ae848c9f855672dd832822c2c97f74a38bed328a5e04675f6779b6de15626e3fbe04b2cd9198f3799ff61401bbbcd76fb011d4fb292
SSDEEP 1536:qWiktEArcHlPhk49U/+AscyeAujXmYUuaoo26oKy2dS9TB24+W+:qWikKAAHnk4u/+0yMjmVC6oKVwdy
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7fcda6ec8384a5efe2b1b9c603cedf43

File Explorer

7fcda6ec8384a5efe2b1b9c603cedf43

.exe 96KB

7fcda6ec8384a5efe2b1b9c603cedf43

IMPHASH a37314695210bd90cfdf3bd06f96ba13
SHA256 73fc50a03a8753c195cfc120e39eef264d51a6c59bf990467383d9aa2a19fd85
MD5 7fcda6ec8384a5efe2b1b9c603cedf43
SHA1 b6faacb5001da58410f5ffeec54726e1283d0fc9
SHA512 ee359992e595374ff7fc8ae848c9f855672dd832822c2c97f74a38bed328a5e04675f6779b6de15626e3fbe04b2cd9198f3799ff61401bbbcd76fb011d4fb292
SSDEEP 1536:qWiktEArcHlPhk49U/+AscyeAujXmYUuaoo26oKy2dS9TB24+W+:qWikKAAHnk4u/+0yMjmVC6oKVwdy
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

193397

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarSub _CIcos _adj_fptan __vbaVarMove __vbaFreeVar __vbaLenBstr __vbaStrVarMove __vbaLateIdCall __vbaFreeVarList __vbaEnd _adj_fdiv_m64 __vbaNextEachVar __vbaFreeObjList _adj_fprem1 ord518 __vbaRecAnsiToUni ord626 __vbaStrCat __vbaVarCmpNe __vbaLsetFixstr __vbaSetSystemError __vbaHresultCheckObj __vbaLenVar _adj_fdiv_m32 ord666 __vbaForEachCollObj __vbaOnError __vbaObjSet _adj_fdiv_m16i _adj_fdivr_m16i __vbaStrFixstr __vbaVarTstLt __vbaBoolVarNull _CIsin __vbaNextEachCollObj __vbaChkstk __vbaFileClose EVENT_SINK_AddRef ord528 __vbaStrCmp __vbaVarTstEq __vbaI2I4 __vbaPrintObj DllFunctionCall __vbaCastObjVar _adj_fpatan __vbaRecUniToAnsi EVENT_SINK_Release ord600 _CIsqrt __vbaVarAnd EVENT_SINK_QueryInterface __vbaVarMul __vbaExceptHandler __vbaStrToUnicode ord712 __vbaPrintFile _adj_fprem _adj_fdivr_m64 ord607 __vbaVarDiv ord608 ord531 __vbaFPException __vbaInStrVar __vbaStrVarVal __vbaVarCat __vbaI2Var __vbaExitEachVar ord645 _CIlog __vbaErrorOverflow __vbaFileOpen __vbaNew2 __vbaVarInt _adj_fdiv_m32i _adj_fdivr_m32i __vbaStrCopy ord573 ord681 __vbaFreeStrList _adj_fdivr_m32 _adj_fdiv_r ord100 __vbaVarTstNe __vbaVarSetVar __vbaI4Var __vbaVarCmpEq __vbaVarAdd __vbaVarDup __vbaStrToAnsi __vbaVarLateMemCallLd __vbaVarCopy ord617 __vbaLateMemCallLd _CIatan __vbaStrMove __vbaForEachVar ord619 _allmul __vbaLateIdSt _CItan __vbaAryUnlock _CIexp __vbaFreeStr __vbaFreeObj

kernel32

GetModuleHandleA LoadLibraryA LocalAlloc LocalFree GetModuleFileNameA ExitProcess

Sharing

General

Malware Config

Signatures

File Explorer

7fcda6ec8384a5efe2b1b9c603cedf43

msvbvm60

kernel32

generic