a9eae7f1d5f7002e2df89eb588dab051

Sharing

Copy URL Twitter E-mail

General

Target

a9eae7f1d5f7002e2df89eb588dab051
Size

6.9MB
MD5

a9eae7f1d5f7002e2df89eb588dab051
SHA1

7aee47fee9b932f7531da7e0303d25413327d2a6
SHA256

35a589402e61b72968bab129d9a5887c7f4312eef8dcca694eb8d080169894cf
SHA512

1d583254f566d58963c494e0be3e0a9dffcaaffd5ac1b165fbfd108b5d6cf8c1e257b2bc0d0675d90ef2428601c7ba2892f577b82a5649e4a1194b396d148f53
SSDEEP

98304:54+m/2Jn+H5M9NUZa81aYD/nQk/52DSjL9fQIUmNoFe6hYwy4s64SV/XGe:54+m4hNU8idH5xjltUmNoFe6Rek/Xd

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

a9eae7f1d5f7002e2df89eb588dab051
.exe windows:6 windows x64 arch:x64

25dda2db45c169fd91626a5db407a3c8

Code Sign

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2031, 00:00

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:7f:11:8c:54:2b:7d:64:04:28:c1:ec:87:a3:37:99
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

24/09/2020, 00:00

Not After

27/09/2023, 12:00

Subject

SERIALNUMBER=1027739867473,CN=Kaspersky Lab JSC,O=Kaspersky Lab JSC,L=Moscow,C=RU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025255

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2031, 00:00

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:7f:11:8c:54:2b:7d:64:04:28:c1:ec:87:a3:37:99
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

24/09/2020, 00:00

Not After

27/09/2023, 12:00

Subject

SERIALNUMBER=1027739867473,CN=Kaspersky Lab JSC,O=Kaspersky Lab JSC,L=Moscow,C=RU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025255

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:6c:67:be:01:f1:61:70:85:66:c9:ef:c5:fe:25:f0:8c:a1:a4:9b:62:5e:ad:4e:ae:1f:bd:a2:0f:e6:8b:5d
Signer

Actual PE Digest

02:6c:67:be:01:f1:61:70:85:66:c9:ef:c5:fe:25:f0:8c:a1:a4:9b:62:5e:ad:4e:ae:1f:bd:a2:0f:e6:8b:5d

Digest Algorithm

sha256

PE Digest Matches

false

51:d7:88:0f:bb:86:15:50:66:b6:7f:49:c7:c6:df:d0:20:3c:45:b4
Signer

Actual PE Digest

51:d7:88:0f:bb:86:15:50:66:b6:7f:49:c7:c6:df:d0:20:3c:45:b4

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ws2_32

WSAStartup

iphlpapi

GetAdaptersAddresses

userenv

GetUserProfileDirectoryW

crypt32

CertFreeCertificateContext

kernel32

GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

GetSystemMetrics
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW

shell32

SHGetSpecialFolderPathA

advapi32

OpenProcessToken

msvcp140

?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z

bcrypt

BCryptGenRandom

vcruntime140

__current_exception_context

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_crt_atexit

api-ms-win-crt-math-l1-1-0

nan

api-ms-win-crt-heap-l1-1-0

_callnewh

api-ms-win-crt-string-l1-1-0

strcmp

api-ms-win-crt-stdio-l1-1-0

_wfopen

api-ms-win-crt-locale-l1-1-0

localeconv

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-utility-l1-1-0

_byteswap_uint64

api-ms-win-crt-filesystem-l1-1-0

_mkdir

wtsapi32

WTSSendMessageW

Sections

.text
Size: - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 3.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RANDOMX
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

_SHA3_25
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

_TEXT_CN
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

_TEXT_CN
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 3.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 6.8MB - Virtual size: 6.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 212B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 469B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

25dda2db45c169fd91626a5db407a3c8

Code Sign

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77Certificate

Key Usages

0e:7f:11:8c:54:2b:7d:64:04:28:c1:ec:87:a3:37:99Certificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77Certificate

Key Usages

0e:7f:11:8c:54:2b:7d:64:04:28:c1:ec:87:a3:37:99Certificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

02:6c:67:be:01:f1:61:70:85:66:c9:ef:c5:fe:25:f0:8c:a1:a4:9b:62:5e:ad:4e:ae:1f:bd:a2:0f:e6:8b:5dSigner

51:d7:88:0f:bb:86:15:50:66:b6:7f:49:c7:c6:df:d0:20:3c:45:b4Signer

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

iphlpapi

userenv

crypt32

kernel32

user32

shell32

advapi32

msvcp140

bcrypt

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

wtsapi32

Sections

.text Size: - Virtual size: 2.6MB

.rdata Size: - Virtual size: 1.1MB

.data Size: - Virtual size: 3.2MB

.pdata Size: - Virtual size: 109KB

_RANDOMX Size: - Virtual size: 3KB

_SHA3_25 Size: - Virtual size: 2KB

_TEXT_CN Size: - Virtual size: 7KB

_TEXT_CN Size: - Virtual size: 4KB

.vmp0 Size: - Virtual size: 3.6MB

.vmp1 Size: 6.8MB - Virtual size: 6.8MB

.reloc Size: 512B - Virtual size: 212B

.rsrc Size: 512B - Virtual size: 469B

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Certificate

0e:7f:11:8c:54:2b:7d:64:04:28:c1:ec:87:a3:37:99
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Certificate

0e:7f:11:8c:54:2b:7d:64:04:28:c1:ec:87:a3:37:99
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

02:6c:67:be:01:f1:61:70:85:66:c9:ef:c5:fe:25:f0:8c:a1:a4:9b:62:5e:ad:4e:ae:1f:bd:a2:0f:e6:8b:5d
Signer

51:d7:88:0f:bb:86:15:50:66:b6:7f:49:c7:c6:df:d0:20:3c:45:b4
Signer

.text
Size: - Virtual size: 2.6MB

.rdata
Size: - Virtual size: 1.1MB

.data
Size: - Virtual size: 3.2MB

.pdata
Size: - Virtual size: 109KB

_RANDOMX
Size: - Virtual size: 3KB

_SHA3_25
Size: - Virtual size: 2KB

_TEXT_CN
Size: - Virtual size: 7KB

_TEXT_CN
Size: - Virtual size: 4KB

.vmp0
Size: - Virtual size: 3.6MB

.vmp1
Size: 6.8MB - Virtual size: 6.8MB

.reloc
Size: 512B - Virtual size: 212B

.rsrc
Size: 512B - Virtual size: 469B