9346334897a015e54f4ee757a6075e01

General

Target
9346334897a015e54f4ee757a6075e01
Size 3.8MB
Sample240205-3b2p5saef4
SHA256 7a38f841eeb9f9e074a87ed7eabdd308f4625934e3acbd88e2dba3fa8c3fc404
MD5 9346334897a015e54f4ee757a6075e01
SHA1 bcc6f63edb4fe656152f93f1e18995d2a535218b
SHA512 d7ffb0c05db06fcf9fba836ce8d0fa0e1ccaba5229667b1741c8ded160dfaff01b522cbb3a6521d3df511f1d1f1c55850de82956754259fd15b08bca1e6d3ff7
SSDEEP 98304:DPwsF1RI8kALdvWlxTupdY/1ncAAaMMsZp:DPBbKA9pG/fA9Zp
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9346334897a015e54f4ee757a6075e01

File Explorer

9346334897a015e54f4ee757a6075e01

.exe 3.8MB

9346334897a015e54f4ee757a6075e01

IMPHASH 47ec2926148c1cdc19bf9946719839ba
SHA256 7a38f841eeb9f9e074a87ed7eabdd308f4625934e3acbd88e2dba3fa8c3fc404
MD5 9346334897a015e54f4ee757a6075e01
SHA1 bcc6f63edb4fe656152f93f1e18995d2a535218b
SHA512 d7ffb0c05db06fcf9fba836ce8d0fa0e1ccaba5229667b1741c8ded160dfaff01b522cbb3a6521d3df511f1d1f1c55850de82956754259fd15b08bca1e6d3ff7
SSDEEP 98304:DPwsF1RI8kALdvWlxTupdY/1ncAAaMMsZp:DPBbKA9pG/fA9Zp
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

9088691

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

343KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

Virtual Size

853KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp1

Size

3.4MB

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

388KB

Virtual Size

384KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

9346334897a015e54f4ee757a6075e01

rasapi32

kernel32

user32

gdi32

winmm

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

ws2_32

wininet

comdlg32

generic

Sharing

General

Malware Config

Signatures

File Explorer

9346334897a015e54f4ee757a6075e01

rasapi32

kernel32

user32

gdi32

winmm

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

ws2_32

wininet

comdlg32

generic