998762s[.]zip | Triage™

resource	yara_rule
static1/unpack001/skanf.exe	vmprotect

resource
unpack001/skanf.exe

998762s.zip

SHA256 769c47ee5e292df1f9b7266913dc08deb86555cc21ae153640e65fcc22907d83
MD5 cef477ce78fbe71b14da11e4634f03d0
SHA1 c33763374ea42c9ac4a7bb02d2d4565f00779186
SHA512 c0bfbacf7837d45c8af3bde098e32b68c10cca25cec80aafcdfc5cce77db0008252d6d71714c2a44822f9c42d2518da37458c79caa7956cc28e2c24e5c879fb6
SSDEEP 98304:AzVjHQMJ2EzdeUbmU6cdlANBcjUAFEmDRP/4JSZhThYIBo+PcC9YVxkxTqb8:ApMQ2EznddGNyUt4QYZhThYeo+PcCCVC
MD5 SHA1 SHA512 SSDEEP

Password

998762s

skanf.exe

IMPHASH 9f35cc034966c27b4c592aae396abb7e
SHA256 f73cf195c3c54cfdd04b117f4a92b3fb074ea29c48d0ffc073c463a47a896284
MD5 4c51ce5fc4565fd3dcaebdafe2773945
SHA1 7ec0e48ec487cdbbba7a1243fc3efba30299d450
SHA512 efeff7994a66ef0fbcb6d1ed17b1ac833d21cb86b24cd61866951ea9f5f474dc4ed6bd956711801465df887b4fa75c40a1b967a97bbc9c19c0d03b4cf001a5dd
SSDEEP 98304:8ZSnJFX5hGZV3oubcGDTuDcvxG5JAiC7HPfg34GF0CrYG1uub78C6FKEYiIq3tvT:80pwb3JbZTvx62iqA3raLBpC6FXs
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Password

998762s

Minor OS version

1

Major OS version

5

Entry point

7209061

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

5.3MB

Virtual Size

5.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

69KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

.reloc

SHA256 6478cdee4763f9cb89a3715e0312ec64807e1da352414bd90f4a65de798efcb7
MD5 966e7f155c0fdb80071cd3ecb63b7deb
SHA1 b8f8ae736bfd9860812b6566093b076f0ecdb1bf
SHA512 65e0224c8a165683e8935003a96ac7d0daaeb6c650960e7af14d3061494b78bbdd294fece575e47f5ee593e312baee39ac9e58f38bcbf8d80ff88e7f95af26d2
MD5 SHA1 SHA512

.rsrc/GROUP_ICON/103

SHA256 b7bcb7a4a1eb976a0a79e0b0d86dc3cc4d82354c2dd2dd6aa25acfdf00e0a201
MD5 4e864c601cb2223d94357293c5f1954a
SHA1 0780e4b5ce1e694524d7ef9de1ad7df3450ffa73
SHA512 f1d10b47a67f06f553642c18ac0d3e181872b39ade4d35f54da3898d33991903fd33f3fec38e2cd4a0d1d6bb455d2b9b0b9d6340ed8e7d74ab54b253544797d2
MD5 SHA1 SHA512

.rsrc/ICON/1.ico

SHA256 2f91ba13aaf72c41105f57e648c4e524cf4497a4038e97dc80fd8db17d597c16
MD5 feca341b06fa1249591a69298d3afb38
SHA1 f94fd2efe8c576a289e1d840e5b2534474743faf
SHA512 7b86bf73ff818d00c087545bcb6997d3a89644f23078d4a3c53776ab7941fa46b4b7a82659b00354c182a861ac7ed73d1a779fe80cbd2f2a8ceb503bb42e3804
MD5 SHA1 SHA512

.rsrc/ICON/10.ico

SHA256 eb3a17b922d0edddc73097770e76f013e43cc74989a36509f6eaf6a439e331bf
MD5 597cd104eb7b661374eea8fb68adb674
SHA1 dc5b07c25407cb60916a884a01cc440bded9bb1a
SHA512 59be8476489275448d7748a6901cc04d4bf050f0e18cadaf5d5c0d9506e0b372889438bfead98b10c2db27f387ba519725db466e716b9ab9654656bd51bdd935
SSDEEP 48:rF/n9u/33iX9c7USzZ9r425Gwl9X84njmqk:rNn9u/3yX9cYSzrjAoPk
MD5 SHA1 SHA512 SSDEEP

.rsrc/ICON/11.ico

SHA256 bb53dd257b3598f845cbd5e909fb9cbb56eb3deabec4a35c96b1639a26c59160
MD5 0a133712fd869ffd69948ca2fe10f054
SHA1 7b9788833d156e83df5907699b11c8c4280d09e7
SHA512 3d3e28b6b30f45304628fc2847c3a456bc4129e88b882e1d89b44e1b9c35214fb40c1e28bd6342797a7bf95773c56781a1bb929c539e44524dc74ac904c30f56
MD5 SHA1 SHA512

.rsrc/ICON/12.ico

SHA256 bece6f340f39a39082a45cd49755d835df38e85b4501d43b74c302bdc643d28b
MD5 fb3ab01761bf5d5189ac486ec36d4864
SHA1 5f915a0af3f1cba5501e7093b436dd2b55c22060
SHA512 3b2acd2f1fd1588c415dc2d5536c59c6397a462be20ab338d06f1dbe12aae80636199a19d346406c63a2df9350fb70d47842589104284cc0f31b919b45c75688
MD5 SHA1 SHA512

.rsrc/ICON/13.ico

SHA256 98d6955fa9ece591743d60ef7fdcc084b7d818ba4d28e7e0f0c28fa99c877e11
MD5 17af8770a2f83c022ba246d8c1d6ab14
SHA1 7867f870e8670bdc655485f4c6079736a4474288
SHA512 8d80a60949c9da106b7069d6b589a7ac90b46cdf87a50c7553f98131af750543e5555227fcc4d3d3f82917109ae6f9ee94702ddf079cefd35a6753f6747a6762
MD5 SHA1 SHA512

.rsrc/ICON/2.ico

SHA256 5a32e32d2ba96b5c5fb393beed544e474bd4e9bdedb3c08cfc169cc5d1c47cd0
MD5 7641b3338200b9078bc8763c062e4168
SHA1 1f78de273da8bf392d7369001fd47266db693144
SHA512 410a512d9b832281f9460bb58d5200d6cdf78a4dd60492abe8781975bd8fbd49d5b820aa94df1da5ca8d7d2f196df08c64a03c57645c2bdf4b558b5bb81be1b5
MD5 SHA1 SHA512

.rsrc/ICON/3.ico

SHA256 c73de177d94cf16d00ddef2f1b9db9e4ad163351456d8f14fda27392dbf78066
MD5 0c9869942193b60648e811416f48c714
SHA1 1e1cc23be9f401837ae38f09183d1209ebf6b1af
SHA512 760612a4387858290aec10c68636028fb8caa409fd5ec5a0c5542bbadcf802bd8a17b6aa6e3204582b209d4e18fa970398cae0b8a08008f55f24efc71d73b7e0
MD5 SHA1 SHA512

.rsrc/ICON/4.ico

SHA256 edcafe9d8ca54024dc75b7f69c0e10b6e6d56219190ac5d01ef43bc3658761a4
MD5 d6dc6dadc9b9edf692998c404ec22133
SHA1 7e887d6931b0d154bfc2eec5aa2d01590341757c
SHA512 549a6241a72f745eb78a1f2645612280ab6ae7dd0f03111f71475a468d80a1571f39cf0ebbf0864a9799828a55052c58598b8be7aeee55314adccd898707358f
MD5 SHA1 SHA512

.rsrc/ICON/5.ico

SHA256 77c0196c0feb7a856ac51dfbf004486cf4bbdc182f9046915353cb2842d85098
MD5 5828fedd1be1d13bee989e2ff519c4bc
SHA1 c5b6f062a136dde75a0d190d9007d03b0644e115
SHA512 ab358ac5ab4eddfba810ffce698743937853f02f1240c2f5b6d71a8dc674b57e5a267c3da83c58bc6b268fca862ac8a2e08a4ead42904fe27e11684ae5108b10
MD5 SHA1 SHA512

.rsrc/ICON/6

SHA256 a07ce8aa77972b2e12673c0d127986658ba446c200eaa439caeb25ded744bce3
MD5 5260bea8823d05052ce361908b4ad553
SHA1 f4f466d14ed8d1724d7da2d6c0db2f50362c0340
SHA512 205a2896df4440e2a4a6a24edd01f846fcd46ae722a7bcbe8da01b1d040f5f657e232a77891997284f0ccdfed3100be8b9790d480b9b69aa995430dcc49742e8
SSDEEP 384:LEQXMuevKQMhiuMGPTT/ABSiHrUAgDc+NXvNLsdMufUeOYLB/13Gw2vhT5Tn+:LEpUQevn0SiHXOXVLaPU3Sx12fhTtn+
MD5 SHA1 SHA512 SSDEEP

Password

998762s

.rsrc/ICON/7.ico

SHA256 97c8d774b17d2b151c62e3587022d896c76fa5b9b947f45e24ac0b2e18aeb6c0
MD5 3d2510d25fb68e0745494e09385d32cb
SHA1 89aecc24d1fcf0f722bb439b80fa12a5b44a8545
SHA512 b8a3b6b7a16f85e78e9e432178dba3a02728ec7d47961dcc0c48b252965eeffdffc68cee0583311466c025ba07eb54d59d1055f7347eb2d549f86648f9ee60bb
SSDEEP 96:8FXkviA+ox4bnza3295xQ1L5Z9S3qW5FBGIJDMZB7UIlG/v:aXKLU+OxQ1LZSzEGtH
MD5 SHA1 SHA512 SSDEEP

.rsrc/ICON/8.ico

SHA256 60efc13ee225795f7476c56c9f5034c1bab9ab50494cfa5c4a5b88ce8a06bab6
MD5 1aee8d13e8b1ca7124d575f028d39598
SHA1 8897fb22e6907a5ae5c03fe186555b53ac631ca1
SHA512 49b652d54e11e604cb0c2c7f2245361c598de22109e3123743c1578a887619998609676de7912b0e9cd167f3cdc3053dfa971d52c6cefa128a1c89541ec32bfe
SSDEEP 48:4vlSMgqdtC/X5qhJ1qErxPOCHJlUZwYmR9escSZsC1TfN7G0SNcgD/n8ucedxywn:4vlS8tYpADqyORREc1+bT1yTv/medz
MD5 SHA1 SHA512 SSDEEP

.rsrc/ICON/9.ico

SHA256 dbc2358f200bdf28fc62124475e8537fdeaa4f236551fb64c828296b17153af1
MD5 9a1891c016d0ead2221e98f7805d9541
SHA1 2911f2f92bf31d8fa79fbe03cb5976766cfc06a4
SHA512 4cc771edce7f4425d1375f995ca698959a2d08a57507f7b53e0f1f70175efa490a720fd9a9e4b97438590839b0070f5e3b4e40a988b038755b15b8bdda7e50d1
SSDEEP 48:6snoYeOLx78Vs+B70Z0gsS3jgmbF9N2gQ8/wB6Lha77nc0wOVv1111111111111v:6snoYeG0FSTgmbFvCWw3nJwOVd
MD5 SHA1 SHA512 SSDEEP

.rsrc/MANIFEST/1

SHA256 97d9168ab7ed15bc99cd4a0a3ef30197cc1c0d2613f2c8bb136aa0ac6e266270
MD5 71e6dc0a76c021a9fc19781a35d5955e
SHA1 504c882d8797328943082182fe6aa74530977fcf
SHA512 a9533bddadfcf76cbd80776602c4a76c50e8d9f0854f97082b9143dd0c2ef62d04408e259149fdfc8babe7124a8b921a42467acedfc47e631522d34fd74a3ce5
MD5 SHA1 SHA512

.rsrc/version.txt

SHA256 afe5bab81334590c3dcd9cf7ece855b50e45b4f2edee4ac315438c616e062120
MD5 b290f138f8173e8a46c0f55a284842e5
SHA1 92b3a55f980438bda789da74d43dbfa713bb718b
SHA512 9da6d4b723ab5e4c7699dfe32c90f77c5cced5f941edfbdcd6a65d827877ccbd761988997ec1dbc8eb853a9fe914bab021f1cb81a1ce2bdf663b983c4adec8ee
MD5 SHA1 SHA512

.vmp1

SHA256 86c0b357620db1323598b8025122329d0ac06d6a15ea748cc6f01fd4aed4b1c7
MD5 c55fd2f141941f3506fea9a0fa7d5d96
SHA1 727cd3f9937b47a2c1a3625c9feb634abf0d341a
SHA512 1b1d4d0c22e443830d87e3f0530053cd786aca893997e12dcbdd527e62a192950d711122bc854f9c0cfb91532a732871b376e1793a7c19c38be55e08597a2a3f
SSDEEP 98304:LZSnJFX5hGZV3oubcGDTuDcvxG5JAiC7HPfg34GF0CrYG1uub78C6FKEYiIq:L0pwb3JbZTvx62iqA3raLBpC6FXs
MD5 SHA1 SHA512 SSDEEP

998762s.zip

skanf.exe

kernel32

ws2_32

wtsapi32

user32

generic

.reloc

.rsrc/GROUP_ICON/103

.rsrc/ICON/1.ico

.rsrc/ICON/10.ico

.rsrc/ICON/11.ico

.rsrc/ICON/12.ico

.rsrc/ICON/13.ico

.rsrc/ICON/2.ico

.rsrc/ICON/3.ico

.rsrc/ICON/4.ico

.rsrc/ICON/5.ico

.rsrc/ICON/6

.rsrc/ICON/7.ico

.rsrc/ICON/8.ico

.rsrc/ICON/9.ico

.rsrc/MANIFEST/1

.rsrc/version.txt

.vmp1

Sharing

General

Malware Config

Signatures

File Explorer

998762s.zip

skanf.exe

kernel32

ws2_32

wtsapi32

user32

generic

.reloc

.rsrc/GROUP_ICON/103

.rsrc/ICON/1.ico

.rsrc/ICON/10.ico

.rsrc/ICON/11.ico

.rsrc/ICON/12.ico

.rsrc/ICON/13.ico

.rsrc/ICON/2.ico

.rsrc/ICON/3.ico

.rsrc/ICON/4.ico

.rsrc/ICON/5.ico

.rsrc/ICON/6

.rsrc/ICON/7.ico

.rsrc/ICON/8.ico

.rsrc/ICON/9.ico

.rsrc/MANIFEST/1

.rsrc/version.txt

.vmp1