VMX[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

VMX.exe
Size

12.8MB
MD5

22300f85398a15b8f00e83318816cefc
SHA1

5015b8b889fd9581235c6b2049b91fede0d49133
SHA256

44a918d110789d18e694fe933c3f0bff9d028a51498d4930f688f69728c96d57
SHA512

143aeff7ac83794d252aaa9b52c776959f92dd23f6052481617a580dc6e0f5737bf4be81a8873a9da75dfb7163089a41e2d58afb6f862d61ae10c7b22e735342
SSDEEP

196608:ruB9QGTFdmaAgv8+isrETS6TxYAUyhPen5O7m55relypOEJ9qMwjUz35+:ru3QMMaAC8FthPenYZlkDdwjUzJ+

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
VMX.exe

Files

VMX.exe
.exe windows:6 windows x64 arch:x64

96577e9aa9185e1ad6e7bb3e0ae36590

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegQueryValueExA

imm32

ImmSetCompositionWindow

kernel32

FormatMessageW
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

msvcp140

??1_Lockit@std@@QEAA@XZ

oleaut32

GetErrorInfo

shell32

ShellExecuteExA

user32

UnregisterClassW
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW

vcruntime140

__current_exception_context

vcruntime140_1

__CxxFrameHandler4

ws2_32

WSAStartup

ucrtbase

wcstol
getenv
_unlock_file
free
localeconv
ceilf
__p___argv
fputc
iswspace
rand

d3d9

Direct3DCreate9

d3dx9_43

D3DXCreateTextureFromFileInMemory

dbghelp

ImageRvaToVa

dwmapi

DwmExtendFrameIntoClientArea

libcurl

curl_easy_cleanup

ntdll

RtlInitUnicodeString

combase

CoCreateGuid
CoTaskMemAlloc

ole32

PropVariantClear

wtsapi32

WTSSendMessageW

Sections

.text
Size: - Virtual size: 456KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: - Virtual size: 392KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.imports
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 6.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: - Virtual size: 4.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ

.SCY
Size: - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp2
Size: - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp3
Size: 12.8MB - Virtual size: 12.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

96577e9aa9185e1ad6e7bb3e0ae36590

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

imm32

kernel32

msvcp140

oleaut32

shell32

user32

vcruntime140

vcruntime140_1

ws2_32

ucrtbase

d3d9

d3dx9_43

dbghelp

dwmapi

libcurl

ntdll

combase

ole32

wtsapi32

Sections

.text Size: - Virtual size: 456KB

Size: - Virtual size: 392KB

Size: - Virtual size: 124KB

Size: - Virtual size: 24KB

Size: - Virtual size: 12KB

Size: - Virtual size: 4KB

.imports Size: - Virtual size: 4KB

.tls Size: - Virtual size: 4KB

.vmp1 Size: - Virtual size: 4KB

.themida Size: - Virtual size: 6.8MB

.boot Size: - Virtual size: 4.1MB

.vmp0 Size: - Virtual size: 4KB

.SCY Size: - Virtual size: 12KB

.vmp2 Size: - Virtual size: 3.2MB

.vmp3 Size: 12.8MB - Virtual size: 12.8MB

.rsrc Size: 4KB - Virtual size: 3KB

.text
Size: - Virtual size: 456KB

.imports
Size: - Virtual size: 4KB

.tls
Size: - Virtual size: 4KB

.vmp1
Size: - Virtual size: 4KB

.themida
Size: - Virtual size: 6.8MB

.boot
Size: - Virtual size: 4.1MB

.vmp0
Size: - Virtual size: 4KB

.SCY
Size: - Virtual size: 12KB

.vmp2
Size: - Virtual size: 3.2MB

.vmp3
Size: 12.8MB - Virtual size: 12.8MB

.rsrc
Size: 4KB - Virtual size: 3KB