cmh_loader_2[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
cmh_loader_2.exe
Size 4.9MB
Sample240322-b4y16see83
SHA256 4a8662cccedb08c848c9117cbda8106225c5c9829cef8283265a6426a8f080dd
MD5 08c2fc32561d0ac2e89042788fce64ef
SHA1 dea7420344b9a425e138e60cbbbb40c1aeaf293d
SHA512 4ff2f29ef6852b31413d3d6a66046d073e56b72854112dc17800aef0cc51072344ddb5f29a7674cc8e086e5b9ad6eeddad9da365c098768a9633224efd491bfa
SSDEEP 98304:WU/R2zLZ95TJBl5nLidox+pSlh8IQu1rlJ5V4zu3PKmZGPe/Wi3:OBnnGWx+8F1r35V4K3PKmYPRi3
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cmh_loader_2.exe

File Explorer

cmh_loader_2.exe

.exe 4.9MB

cmh_loader_2.exe

IMPHASH 2d388c2b3c4b359dd8f28c9feffc7879
SHA256 4a8662cccedb08c848c9117cbda8106225c5c9829cef8283265a6426a8f080dd
MD5 08c2fc32561d0ac2e89042788fce64ef
SHA1 dea7420344b9a425e138e60cbbbb40c1aeaf293d
SHA512 4ff2f29ef6852b31413d3d6a66046d073e56b72854112dc17800aef0cc51072344ddb5f29a7674cc8e086e5b9ad6eeddad9da365c098768a9633224efd491bfa
SSDEEP 98304:WU/R2zLZ95TJBl5nLidox+pSlh8IQu1rlJ5V4zu3PKmZGPe/Wi3:OBnnGWx+8F1r35V4K3PKmYPRi3
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5006673

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d9

Direct3DCreate9

kernel32

GetModuleHandleW FreeLibrary VerifyVersionInfoW QueryPerformanceCounter SetHandleInformation GetBinaryTypeW VirtualProtect VirtualFree GetCurrentProcess GetModuleHandleExW VirtualAlloc RtlAddFunctionTable GetEnvironmentVariableW GetWriteWatch CreateMutexW ResetWriteWatch GlobalGetAtomNameW CreateToolhelp32Snapshot Process32NextW GetCurrentThread Process32FirstW CloseHandle GetSystemInfo K32GetModuleInformation GetThreadContext HeapQueryInformation ReadProcessMemory VirtualQuery IsDebuggerPresent CheckRemoteDebuggerPresent GetVolumeInformationW Sleep GetComputerNameW GetLastError SetLastError SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW VerSetConditionMask GetCommandLineA GetOEMCP GetACP IsValidCodePage HeapSize CreateProcessW GetExitCodeProcess WaitForSingleObject HeapReAlloc GetFileSizeEx GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW HeapFree HeapAlloc GetFileType ReadConsoleW GetConsoleMode WriteFile GetStdHandle GetModuleFileNameW ExitProcess ReadFile LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc RaiseException GetProcAddress QueryPerformanceFrequency LoadLibraryA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar WriteConsoleW GetCommandLineW RtlPcToFileHeader InterlockedPushEntrySList RtlUnwindEx GetCurrentProcessId GetStartupInfoW InitializeSListHead IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext CreateEventW ResetEvent LocalFree FormatMessageA CreateDirectoryW CreateFileW FindClose FindFirstFileExW FindNextFileW RtlUnwind GetFileAttributesExW SetEndOfFile SetFilePointerEx AreFileApisANSI GetFileInformationByHandleEx InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId WaitForSingleObjectEx FlsAlloc FlsGetValue FlsSetValue FlsFree GetSystemTimeAsFileTime EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo GetStringTypeW InitializeCriticalSectionAndSpinCount SetEvent GetSystemTimeAsFileTime GetModuleHandleA CreateEventA GetModuleFileNameW LoadLibraryA TerminateProcess GetCurrentProcess CreateToolhelp32Snapshot Thread32First GetCurrentProcessId GetCurrentThreadId OpenThread Thread32Next CloseHandle SuspendThread ResumeThread WriteProcessMemory GetSystemInfo VirtualAlloc VirtualProtect VirtualFree GetProcessAffinityMask SetProcessAffinityMask GetCurrentThread SetThreadAffinityMask Sleep FreeLibrary GetTickCount SystemTimeToFileTime FileTimeToSystemTime GlobalFree LocalAlloc LocalFree GetProcAddress ExitProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetModuleHandleW LoadResource MultiByteToWideChar FindResourceExW FindResourceExA WideCharToMultiByte GetThreadLocale GetUserDefaultLCID GetSystemDefaultLCID EnumResourceNamesA EnumResourceNamesW EnumResourceLanguagesA EnumResourceLanguagesW EnumResourceTypesA EnumResourceTypesW CreateFileW LoadLibraryW GetLastError FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle FlsSetValue GetCommandLineA RaiseException RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx HeapFree GetCPInfo GetACP GetOEMCP IsValidCodePage EncodePointer DecodePointer FlsGetValue FlsFree SetLastError FlsAlloc UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext HeapAlloc LCMapStringA LCMapStringW SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapSetInformation HeapCreate HeapDestroy QueryPerformanceCounter GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize WriteFile SetFilePointer GetConsoleCP GetConsoleMode HeapReAlloc InitializeCriticalSectionAndSpinCount LocalAlloc LocalFree GetModuleFileNameW GetProcessAffinityMask SetProcessAffinityMask SetThreadAffinityMask Sleep ExitProcess FreeLibrary LoadLibraryA GetModuleHandleA GetProcAddress

user32

ScreenToClient GetCursorPos ReleaseDC SetCursorPos IsIconic SetForegroundWindow ReleaseCapture GetClientRect SetWindowLongW SetCursor SetClipboardData GetClipboardData EmptyClipboard CloseClipboard SetCapture DispatchMessageW PeekMessageW TranslateMessage wsprintfW PostQuitMessage UpdateWindow GetWindowLongW DefWindowProcW AdjustWindowRectEx GetKeyState DestroyWindow GetDC SetWindowPos MonitorFromWindow EnumDisplayMonitors CreateWindowExW LoadCursorW UnregisterClassW SetWindowTextW RegisterClassExW WindowFromPoint ShowWindow GetCapture GetMonitorInfoW ClientToScreen IsChild GetForegroundWindow SetLayeredWindowAttributes SetFocus BringWindowToTop OpenClipboard GetUserObjectInformationW CharUpperBuffW MessageBoxW GetProcessWindowStation GetProcessWindowStation GetUserObjectInformationW

gdi32

GetDeviceCaps

advapi32

CryptAcquireContextA CryptGenRandom CryptReleaseContext

imm32

ImmReleaseContext ImmGetContext ImmSetCompositionWindow

ws2_32

htons recv connect socket send inet_addr WSAStartup select closesocket

d3dx9_43

D3DXCreateTextureFromFileInMemory

wtsapi32

WTSSendMessageW

Name

.text

Size

Virtual Size

788KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

175KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

631KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vmp0

Size

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

4.9MB

Virtual Size

4.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

172B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

cmh_loader_2.exe

d3d9

kernel32

user32

gdi32

advapi32

imm32

ws2_32

d3dx9_43

wtsapi32

generic