2d42930929e8cadad933f70ffd753b2bf63fbe91de1dd23fdac4ea07deb2628f

Sharing

Copy URL

Twitter E-mail

General

Target

2d42930929e8cadad933f70ffd753b2bf63fbe91de1dd23fdac4ea07deb2628f
Size

10.5MB
MD5

d2a5cc5ec0b9e8d478510f21e831cda0
SHA1

4ab4fe15ab643cf9f5cc91a2a51c18aaac14aaeb
SHA256

2d42930929e8cadad933f70ffd753b2bf63fbe91de1dd23fdac4ea07deb2628f
SHA512

f6cc5955b2d0d6a265918ffda8248afcc156c9137bb06f8b989f3b899881aeed281b6c4fa94e0b99df68f90f593744bd2def4a6f9ea0ee34caeaecb4cda6368a
SSDEEP

196608:jL6QX13hkMfNTjkk/cM7eveSlI2Hto92cIosgERj1Cafy/RJh6xIdB0966AOM:jvF3hk2fcMavnI+FO2mRJhbB2nM

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

2d42930929e8cadad933f70ffd753b2bf63fbe91de1dd23fdac4ea07deb2628f
.exe windows:6 windows x86 arch:x86

68db9332b80cc8a1d6c42d5645dd1ece

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

5d:17:88:6f:95:97:32:5f
Certificate

Issuer

CN=Tencent,OU=Tencent_Technology(Shenzhen)_Company_Limited+OU=Tencent,O=Tencent_Technology(Shenzhen)_Company_Limited+O=Tencent,L=Tencent_Technology(Shenzhen)_Company_Limited+L=Tencent,ST=Tencent_Technology(Shenzhen)_Company_Limited+ST=Tencent,C=Tencent+C=Tencent,1.2.840.113549.1.9.1=#0c2c54656e63656e745f546563686e6f6c6f6779285368656e7a68656e295f436f6d70616e795f4c696d69746564

Not Before

06-02-2024 00:00

Not After

05-02-2025 23:59

Subject

CN=Tencent,OU=Tencent_Technology(Shenzhen)_Company_Limited+OU=Tencent,O=Tencent_Technology(Shenzhen)_Company_Limited+O=Tencent,L=Tencent_Technology(Shenzhen)_Company_Limited+L=Tencent,ST=Tencent_Technology(Shenzhen)_Company_Limited+ST=Tencent,C=Tencent+C=Tencent,1.2.840.113549.1.9.1=#0c2c54656e63656e745f546563686e6f6c6f6779285368656e7a68656e295f436f6d70616e795f4c696d69746564

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

5d:17:88:6f:95:97:32:5f
Certificate

Issuer

CN=Tencent,OU=Tencent_Technology(Shenzhen)_Company_Limited+OU=Tencent,O=Tencent_Technology(Shenzhen)_Company_Limited+O=Tencent,L=Tencent_Technology(Shenzhen)_Company_Limited+L=Tencent,ST=Tencent_Technology(Shenzhen)_Company_Limited+ST=Tencent,C=Tencent+C=Tencent,1.2.840.113549.1.9.1=#0c2c54656e63656e745f546563686e6f6c6f6779285368656e7a68656e295f436f6d70616e795f4c696d69746564

Not Before

06-02-2024 00:00

Not After

05-02-2025 23:59

Subject

CN=Tencent,OU=Tencent_Technology(Shenzhen)_Company_Limited+OU=Tencent,O=Tencent_Technology(Shenzhen)_Company_Limited+O=Tencent,L=Tencent_Technology(Shenzhen)_Company_Limited+L=Tencent,ST=Tencent_Technology(Shenzhen)_Company_Limited+ST=Tencent,C=Tencent+C=Tencent,1.2.840.113549.1.9.1=#0c2c54656e63656e745f546563686e6f6c6f6779285368656e7a68656e295f436f6d70616e795f4c696d69746564

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCRLSign

47:e7:aa:d6:95:3c:37:c8:62:dd:5c:41:00:80:8c:95:d2:21:82:8a:5b:d2:9c:e9:46:d7:65:a0:90:7c:c2:b8
Signer

Actual PE Digest

47:e7:aa:d6:95:3c:37:c8:62:dd:5c:41:00:80:8c:95:d2:21:82:8a:5b:d2:9c:e9:46:d7:65:a0:90:7c:c2:b8

Digest Algorithm

sha256

PE Digest Matches

true

47:e7:aa:d6:95:3c:37:c8:62:dd:5c:41:00:80:8c:95:d2:21:82:8a:5b:d2:9c:e9:46:d7:65:a0:90:7c:c2:b8
Signer

Actual PE Digest

47:e7:aa:d6:95:3c:37:c8:62:dd:5c:41:00:80:8c:95:d2:21:82:8a:5b:d2:9c:e9:46:d7:65:a0:90:7c:c2:b8

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

LoadCursorW
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW

gdi32

GetObjectType

winspool.drv

ClosePrinter

advapi32

RegQueryValueExA

shell32

SHGetFileInfoA

ole32

IsAccelerator

oleaut32

SystemTimeToVariantTime

msimg32

TransparentBlt

shlwapi

PathFindExtensionA

uxtheme

GetThemeSysColor

gdiplus

GdipGetImagePalette

oleacc

LresultFromObject

imm32

ImmReleaseContext

winmm

PlaySoundA

wtsapi32

WTSSendMessageW

Exports

Exports

HP_Loader

Sections

.text
Size: - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 290KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 7.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 10.4MB - Virtual size: 10.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 92KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

68db9332b80cc8a1d6c42d5645dd1ece

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

5d:17:88:6f:95:97:32:5fCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

5d:17:88:6f:95:97:32:5fCertificate

Extended Key Usages

Key Usages

47:e7:aa:d6:95:3c:37:c8:62:dd:5c:41:00:80:8c:95:d2:21:82:8a:5b:d2:9c:e9:46:d7:65:a0:90:7c:c2:b8Signer

47:e7:aa:d6:95:3c:37:c8:62:dd:5c:41:00:80:8c:95:d2:21:82:8a:5b:d2:9c:e9:46:d7:65:a0:90:7c:c2:b8Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

oleaut32

msimg32

shlwapi

uxtheme

gdiplus

oleacc

imm32

winmm

wtsapi32

Exports

Exports

Sections

.text Size: - Virtual size: 1.4MB

.rdata Size: - Virtual size: 290KB

.data Size: - Virtual size: 43KB

.vmp0 Size: - Virtual size: 7.9MB

.vmp1 Size: 10.4MB - Virtual size: 10.4MB

.reloc Size: 2KB - Virtual size: 1KB

.rsrc Size: 92KB - Virtual size: 91KB

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

5d:17:88:6f:95:97:32:5f
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

5d:17:88:6f:95:97:32:5f
Certificate

47:e7:aa:d6:95:3c:37:c8:62:dd:5c:41:00:80:8c:95:d2:21:82:8a:5b:d2:9c:e9:46:d7:65:a0:90:7c:c2:b8
Signer

47:e7:aa:d6:95:3c:37:c8:62:dd:5c:41:00:80:8c:95:d2:21:82:8a:5b:d2:9c:e9:46:d7:65:a0:90:7c:c2:b8
Signer

.text
Size: - Virtual size: 1.4MB

.rdata
Size: - Virtual size: 290KB

.data
Size: - Virtual size: 43KB

.vmp0
Size: - Virtual size: 7.9MB

.vmp1
Size: 10.4MB - Virtual size: 10.4MB

.reloc
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 92KB - Virtual size: 91KB