682b6ef619a4bb240c23ccf8bfb827ea[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

682b6ef619a4bb240c23ccf8bfb827ea.bin
Size

6.1MB
MD5

57dab6995ba61c77ce1c2a26608caa99
SHA1

f50ddcf98756a561544412107198d8b742c77526
SHA256

cab6d3c5f44708d11168f0ded6cbdd47f566f2e05bc0060af20c5f098f4a0c3a
SHA512

1d8af872cb4148bcb7a4b85734f594c64a1b227bc952e7428f3f56de41cf5bc5798296ed6c11c1e510d8db3f657416d2ed7ba525ae9f1e0b5f3de48131ecbca1
SSDEEP

98304:8E/ptF1FV+tdkZrzK6VAuOIJfUvq3QB0t8TY5+57HlCA17poDrvzd3/lBWm2M8/:h/p5FV+tdWvKOAIUHc5Fr56+y

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
static1/unpack001/4c30b85739743226d4c40bf6c25a1672de66ec2902ca85f2d36a2e043c3f9cf5.exe	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/4c30b85739743226d4c40bf6c25a1672de66ec2902ca85f2d36a2e043c3f9cf5.exe

Files

682b6ef619a4bb240c23ccf8bfb827ea.bin
.zip

Password: infected
4c30b85739743226d4c40bf6c25a1672de66ec2902ca85f2d36a2e043c3f9cf5.exe
.dll windows:6 windows x64 arch:x64

Password: infected

cc31c556b4b3354e9a6d8d57a19bcd62

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleFileNameA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

GetAsyncKeyState
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW

msvcp140

_Cnd_destroy_in_situ

dbghelp

StackWalk64

imm32

ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

dwmapi

DwmGetColorizationColor

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_terminate

api-ms-win-crt-heap-l1-1-0

free

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-stdio-l1-1-0

_fileno

api-ms-win-crt-math-l1-1-0

_dsign

api-ms-win-crt-filesystem-l1-1-0

_lock_file

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-locale-l1-1-0

localeconv

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

strcmp

gdi32

CreateRectRgn

advapi32

RegQueryValueExW

wtsapi32

WTSSendMessageW

Sections

.text
Size: - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 804KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 538KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 3.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 6.5MB - Virtual size: 6.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 188B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

cc31c556b4b3354e9a6d8d57a19bcd62

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

msvcp140

dbghelp

imm32

d3dcompiler_47

dwmapi

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

gdi32

advapi32

wtsapi32

Sections

.text Size: - Virtual size: 1.9MB

.rdata Size: - Virtual size: 804KB

.data Size: - Virtual size: 538KB

.pdata Size: - Virtual size: 70KB

_RDATA Size: - Virtual size: 76KB

.vmp0 Size: - Virtual size: 3.7MB

.vmp1 Size: 6.5MB - Virtual size: 6.5MB

.reloc Size: 512B - Virtual size: 188B

.text
Size: - Virtual size: 1.9MB

.rdata
Size: - Virtual size: 804KB

.data
Size: - Virtual size: 538KB

.pdata
Size: - Virtual size: 70KB

_RDATA
Size: - Virtual size: 76KB

.vmp0
Size: - Virtual size: 3.7MB

.vmp1
Size: 6.5MB - Virtual size: 6.5MB

.reloc
Size: 512B - Virtual size: 188B