81ddcb7db1642a2ff87ba7c0492334fa

Sharing

Copy URL Twitter E-mail

General

Target
81ddcb7db1642a2ff87ba7c0492334fa
Size 73KB
Sample240130-jm2pqschek
SHA256 c74be69bc6eda5a6f00848c553dac0af87da28a1fb78d2a895559d4f46cb6ac0
MD5 81ddcb7db1642a2ff87ba7c0492334fa
SHA1 a34ce3627c682a770e216bbd41ff55365756900a
SHA512 c4f00081cd6a692335426f1f40da8f612a89a987b5dcabb6bd784f62b267c6a28420c8cb1ead6cffc26d0775d7ef10dffc2a5fd95c2bfb5bd9129cf981025730
SSDEEP 1536:q0K703Y7q6Vf3AQLFnToIfyTFjr5ZWN7WPHvR7J5sIF6NM1:X6Vf3AQLtTBfyTFjr5ZWN7WXRJyI8
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
81ddcb7db1642a2ff87ba7c0492334fa

File Explorer

81ddcb7db1642a2ff87ba7c0492334fa

.dll 73KB

81ddcb7db1642a2ff87ba7c0492334fa

IMPHASH 464cf6a629642e7e1626b35ad8e7a859
SHA256 c74be69bc6eda5a6f00848c553dac0af87da28a1fb78d2a895559d4f46cb6ac0
MD5 81ddcb7db1642a2ff87ba7c0492334fa
SHA1 a34ce3627c682a770e216bbd41ff55365756900a
SHA512 c4f00081cd6a692335426f1f40da8f612a89a987b5dcabb6bd784f62b267c6a28420c8cb1ead6cffc26d0775d7ef10dffc2a5fd95c2bfb5bd9129cf981025730
SSDEEP 1536:q0K703Y7q6Vf3AQLFnToIfyTFjr5ZWN7WPHvR7J5sIF6NM1:X6Vf3AQLtTBfyTFjr5ZWN7WXRJyI8
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

28081

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetModuleFileNameA lstrcpynA WinExec MoveFileExA GetTickCount GetFileSize CreateFileA WriteFile FreeConsole CreateThread GetVersionExA GetComputerNameA InterlockedExchange HeapAlloc GetProcessHeap GetCurrentProcessId GetCurrentThreadId WaitForSingleObject lstrcpyA OpenProcess TerminateProcess CreateToolhelp32Snapshot Process32First Module32First Process32Next lstrlenA SetLastError LoadLibraryA GetProcAddress FreeLibrary GetCurrentProcess MoveFileA CopyFileA DeleteFileA FindFirstFileA FileTimeToLocalFileTime FileTimeToSystemTime GetLastError FindNextFileA FindClose Sleep GetLogicalDriveStringsA GetDriveTypeA CreatePipe CloseHandle GetStartupInfoA GetSystemDirectoryA CreateProcessA ReadFile GlobalMemoryStatus

user32

mouse_event CreateWindowExA CloseWindow SendMessageA IsWindow GetSystemMetrics SetThreadDesktop ExitWindowsEx SetProcessWindowStation OpenWindowStationA GetThreadDesktop GetProcessWindowStation CloseDesktop CloseWindowStation SetCursorPos GetDesktopWindow wsprintfA keybd_event OpenDesktopA

gdi32

CreateCompatibleBitmap GetDIBits CreateDCA DeleteDC CreateCompatibleDC SelectObject DeleteObject BitBlt

advapi32

OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges SetServiceStatus RegisterServiceCtrlHandlerA DeleteService CreateServiceA RegOpenKeyA RegCreateKeyA RegOpenKeyExA RegSetValueExA QueryServiceStatus CloseServiceHandle StartServiceA ChangeServiceConfigA OpenServiceA OpenSCManagerA ControlService RegCloseKey

shell32

ShellExecuteA SHGetFileInfoA

msvcrt

wcstombs _adjust_fdiv _initterm free _onexit __dllonexit ??1type_info@@UAE@XZ malloc srand rand _strlwr _ftol strstr strcspn atoi ??3@YAXPAX@Z _except_handler3 _CxxThrowException __CxxFrameHandler strncat strncpy sprintf ??2@YAPAXI@Z

avicap32

capCreateCaptureWindowA capGetDriverDescriptionA

ws2_32

recv gethostbyname inet_addr WSAStartup shutdown closesocket connect socket htons sendto htonl WSASocketA setsockopt WSAIoctl send

shlwapi

StrStrIA

Name

.text

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vmp0

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

81ddcb7db1642a2ff87ba7c0492334fa

kernel32

user32

gdi32

advapi32

shell32

msvcrt

avicap32

ws2_32

shlwapi

generic