tmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

tmp
Size

5.8MB
MD5

6375775fa75571700ee84baecb7df763
SHA1

98090cb4369c07042091877570d1d326f494ae55
SHA256

47a33bd5511167982e0de1b35d2c690cc510b31359e6aab902d595cedc2b2e1c
SHA512

df80acd8a774af16894c6c849c55208ee47b4d8dfa794672e95d92edba241df5dbf57f7430900b0520b1789ae2e799b1fb2949d7569b39f10a32469cd8c14cdf
SSDEEP

98304:yPSKeu8Ynx4B0vCIGVHlYGI5BI5v3x9s/7TxjvzZOpZJPtiVvF/j0:iSKQaKLHlQB8fxKmL4hj

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tmp

Files

tmp
.exe windows:6 windows x86 arch:x86

939d2987524498003163dcc87fc3fcda

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

GetDC
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW

gdi32

BitBlt

wtsapi32

WTSSendMessageW

Sections

.text
Size: - Virtual size: 350KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 5.8MB - Virtual size: 5.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ