f7ea997ecb3f1b3d9669ead7539d2b0b7da60ac08279e5bb09aaed20a97efa9d[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

f7ea997ecb3f1b3d9669ead7539d2b0b7da60ac08279e5bb09aaed20a97efa9d.exe
Size

94.7MB
MD5

827c2735811297a85b5115cdc701b868
SHA1

0597c01af54d280b883c003cd46df13d861c22bc
SHA256

f7ea997ecb3f1b3d9669ead7539d2b0b7da60ac08279e5bb09aaed20a97efa9d
SHA512

4be0e9ecde5df53036a1db3523fbb14f781be1b2575db091e5a46474930d3b94786c1964c9c6728192a710532dd6371686a4f3598a56d2b3b2e5c843d1273c2e
SSDEEP

1572864:LPaJRyFcjmUMDt4nVFQuY84u2inv9uVdG1IXHDkPZLDL8wrPyTgrB:09joWVKXTinvQQ1IXeLDL8wrysrB

Score

10^/10

Malware Config

Signatures

Detects executables packed with VMProtect. 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_VMProtect

Files

f7ea997ecb3f1b3d9669ead7539d2b0b7da60ac08279e5bb09aaed20a97efa9d.exe
.exe windows:5 windows x86 arch:x86

f3bc7307a737af2e91a18c2deb1d81cc

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

29:5b:f8:6e:85:26:53:40:33:13:83:7b
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

26/04/2023, 03:04

Not After

26/04/2026, 03:04

Subject

SERIALNUMBER=911101026662879416,CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,STREET=朝阳区酒仙桥路6号院2号楼1至19层104号内8层801,L=Beijing,ST=Beijing,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

06/04/2022, 07:44

Not After

08/05/2033, 07:44

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20/02/2019, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

cd:62:e7:a4:b3:47:fe:d7:00:37:80:73:f4:cc:b3:3b:6d:39:d1:f4:b9:a0:7b:8e:ab:9c:c6:da:70:a6:ec:07
Signer

Actual PE Digest

cd:62:e7:a4:b3:47:fe:d7:00:37:80:73:f4:cc:b3:3b:6d:39:d1:f4:b9:a0:7b:8e:ab:9c:c6:da:70:a6:ec:07

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\vmagent_new\bin\joblist\728886\out\Release_tr\Setup.pdb

Imports

kernel32

QueryPerformanceFrequency
lstrlenA
SystemTimeToFileTime
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileTime
InterlockedExchange
GetCurrentDirectoryA
PeekNamedPipe
GetFullPathNameA
GetDriveTypeA
QueryDosDeviceW
GetVolumeNameForVolumeMountPointW
GetDiskFreeSpaceExW
GlobalAddAtomW
FindAtomW
CreateEventW
GetEnvironmentVariableW
GetLogicalDriveStringsW
GetWindowsDirectoryW
GetDriveTypeW
GetCurrentThreadId
MulDiv
GetCurrentProcess
FlushInstructionCache
GlobalAlloc
GlobalFree
GetTickCount
GetCommandLineW
LoadLibraryExW
MultiByteToWideChar
lstrcmpiW
FormatMessageA
ExpandEnvironmentStringsA
GetSystemDirectoryA
VerSetConditionMask
VerifyVersionInfoA
SleepEx
FreeResource
GetSystemWindowsDirectoryW
lstrcmpiA
lstrcmpA
SetEnvironmentVariableA
CompareStringW
CompareStringA
FlushFileBuffers
GetLocaleInfoW
LeaveCriticalSection
GetConsoleOutputCP
WriteConsoleA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStartupInfoA
SetHandleCount
GetFileType
SetStdHandle
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetTimeZoneInformation
GetModuleHandleA
HeapCreate
InitializeCriticalSectionAndSpinCount
GetModuleFileNameA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
LCMapStringA
GetConsoleMode
GetConsoleCP
SetEvent
GetSystemTime
TerminateProcess
GetCurrentThread
CreateProcessW
GlobalDeleteAtom
CreateMutexW
PostQueuedCompletionStatus
CreateIoCompletionPort
GetQueuedCompletionStatus
CreateThread
TerminateThread
OutputDebugStringW
GetFileSizeEx
CompareFileTime
QueryPerformanceCounter
GetFullPathNameW
SetLastError
lstrlenW
lstrcpyW
DeleteCriticalSection
InitializeCriticalSection
RaiseException
FindFirstFileW
FindNextFileW
FindClose
LocalAlloc
GetVersionExW
CopyFileW
MoveFileW
MoveFileExW
GetPrivateProfileStringW
GlobalFindAtomW
Sleep
GetFileAttributesW
WriteFile
CreateDirectoryW
GetTempPathW
GetTempFileNameW
WritePrivateProfileStringW
SetFileAttributesW
InterlockedDecrement
RemoveDirectoryW
DeleteFileW
GetLastError
GetProcessHeap
HeapAlloc
HeapFree
GetSystemDirectoryW
ReadFile
SetFilePointer
GetCurrentProcessId
CreateFileW
DeviceIoControl
LoadLibraryW
InterlockedIncrement
GetModuleFileNameW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
CloseHandle
WaitForSingleObject
GetModuleHandleW
GetProcAddress
GetSystemInfo
GlobalMemoryStatusEx
FreeLibrary
LocalFree
FindResourceExW
FindResourceW
LoadResource
LockResource
GetStartupInfoW
ExitProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlUnwind
ExitThread
TlsFree
ReleaseMutex
HeapWalk
HeapLock
OpenThread
HeapUnlock
SetFilePointerEx
GetSystemTimeAsFileTime
CreateFileA
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
HeapSize
HeapReAlloc
HeapDestroy
TlsAlloc
LockFile
GetStdHandle
SetConsoleTextAttribute
GetFileInformationByHandle
LocalFileTimeToFileTime
GetFileAttributesA
DosDateTimeToFileTime
TlsGetValue
TlsSetValue
ResetEvent
ReadProcessMemory
OpenMutexW
GetExitCodeProcess
GetLongPathNameW
MapViewOfFile
LockFileEx
GetFileAttributesExW
UnlockFile
FindNextFileA
FindFirstFileA
GetVersion
InterlockedCompareExchange
EnterCriticalSection
OpenProcess
GetVolumeInformationW
FormatMessageW
SetFileTime
SetEndOfFile
WideCharToMultiByte
UnmapViewOfFile
GetFileSize
CreateFileMappingW
GetLocalTime
WriteConsoleW
SizeofResource

user32

InflateRect
wvsprintfW
PostMessageW
GetActiveWindow
SendMessageW
SendMessageTimeoutW
FindWindowW
CharNextW
IsWindow
EnableWindow
GetDlgItem
IsWindowEnabled
ShowWindow
SetDlgItemTextW
IsWindowVisible
SetForegroundWindow
EndDialog
GetWindowLongW
SetWindowTextW
MoveWindow
SetWindowPos
GetClientRect
ScreenToClient
MapWindowPoints
GetMonitorInfoW
MonitorFromWindow
GetWindowRect
GetWindow
GetParent
GetDC
ReleaseDC
SetWindowLongW
UnregisterClassA
ExitWindowsEx
GetWindowTextW
FindWindowExW
InvalidateRect
RedrawWindow
GetDlgCtrlID
SetFocus
MessageBeep
GetWindowTextLengthW
CreateDialogParamW
SetWindowRgn
SetTimer
KillTimer
CopyRect
DefWindowProcW
CallWindowProcW
BeginPaint
EndPaint
wsprintfW
DialogBoxParamW
EnableMenuItem
DestroyWindow
GetSystemMenu
GetClassInfoExW
LoadCursorW
PostQuitMessage
IsIconic
SystemParametersInfoW
LoadIconW
RegisterClassExW
CreateWindowExW
LoadImageW
GetSystemMetrics
PtInRect
GetCursorPos
BringWindowToTop
DispatchMessageW
TrackMouseEvent
GetShellWindow
PostThreadMessageW
UpdateLayeredWindow
GetWindowThreadProcessId
PeekMessageW
GetMessageW
TranslateMessage
MessageBoxW

gdi32

CreateSolidBrush
GetDeviceCaps
CreateCompatibleBitmap
SelectObject
BitBlt
DeleteDC
SetBkColor
CombineRgn
CreateRectRgn
SetViewportOrgEx
CreateDIBSection
EnumFontFamiliesW
DeleteObject
CreateCompatibleDC

advapi32

RegCloseKey
ImpersonateLoggedOnUser
RevertToSelf
OpenProcessToken
DuplicateTokenEx
OpenSCManagerW
OpenServiceW
QueryServiceStatusEx
CloseServiceHandle
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenThreadToken
ImpersonateSelf
AllocateAndInitializeSid
FreeSid
SetSecurityInfo
GetSecurityInfo
GetSecurityDescriptorSacl
IsValidSid
CopySid
RegQueryValueExW
RegQueryInfoKeyW
GetExplicitEntriesFromAclW
GetTrusteeNameW
DeleteAce
LookupAccountSidW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyW
RegEnumKeyExW
RegOpenKeyExW
RegDeleteValueW
RegEnumValueW
CryptCreateHash
RegDeleteKeyW
GetUserNameW
LookupAccountNameW
GetFileSecurityW
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
GetAclInformation
GetLengthSid
InitializeAcl
GetAce
EqualSid
AddAce
AddAccessAllowedAce
SetSecurityDescriptorDacl
GetSecurityDescriptorControl
SetFileSecurityW
GetNamedSecurityInfoW
BuildExplicitAccessWithNameW
SetEntriesInAclW
SetNamedSecurityInfoW
CryptHashData
RegOpenKeyExA
RegQueryValueExA
RegQueryInfoKeyA
RegEnumKeyExA
RegEnumValueA
ChangeServiceConfigW
ControlService
GetTokenInformation
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
CryptDestroyHash
CryptGetHashParam

shell32

SHGetSpecialFolderPathA
CommandLineToArgvW
ShellExecuteW
ShellExecuteExW
ord680
SHFileOperationW
SHChangeNotify
SHBrowseForFolderW
SHGetSpecialFolderPathW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetMalloc
SHCreateDirectoryExW
ord165

ole32

CoInitializeSecurity
CoSetProxyBlanket
CoInitializeEx
CreateStreamOnHGlobal
CoUninitialize
CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateGuid
CoInitialize
OleRun

oleaut32

VarUI4FromStr
VariantChangeType
SysAllocStringLen
SysAllocStringByteLen
VariantClear
VariantInit
SysFreeString
SysStringLen
SysAllocString
SysStringByteLen

shlwapi

PathRemoveExtensionW
PathFindFileNameW
PathAddBackslashW
PathIsDirectoryW
StrStrIA
PathUnquoteSpacesW
PathMatchSpecW
StrRetToStrW
PathIsSameRootW
StrCatW
StrCpyW
PathIsPrefixW
PathIsDirectoryEmptyW
PathCombineA
wnsprintfW
SHSetValueW
PathFileExistsW
SHGetValueW
SHDeleteValueW
PathFileExistsA
SHGetValueA
PathCombineW
PathAppendW
PathIsRelativeW
SHDeleteKeyW
StrStrIW
PathRemoveFileSpecW
StrCmpIW
SHSetValueA
StrTrimA
StrCmpW
PathAppendA
PathRemoveArgsW
StrCmpNIW
PathFindExtensionW
PathCommonPrefixW

comctl32

InitCommonControlsEx

crypt32

CertDeleteCertificateFromStore
CertCompareCertificate
CertDuplicateCertificateContext
CertCloseStore
CertGetNameStringW
CertEnumCertificatesInStore
CertOpenStore
CryptStringToBinaryA
CertGetCertificateChain
CertFreeCertificateChainEngine
CertFreeCertificateChain
CertGetNameStringA
CryptQueryObject
CertAddCertificateContextToStore
CertFindCertificateInStore
CertCreateCertificateChainEngine
CertFreeCertificateContext

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

psapi

EnumProcesses
GetProcessImageFileNameW
GetModuleFileNameExW

rpcrt4

NdrServerCall2
RpcBindingFree
RpcStringFreeW
RpcBindingFromStringBindingW
NdrAsyncServerCall
RpcStringBindingComposeW
NdrAsyncClientCall
NdrClientCall2

gdiplus

GdipClosePathFigure
GdipCreateSolidFill
GdipAddPathBezierI
GdipSetTextRenderingHint
GdipSetSmoothingMode
GdipTranslateWorldTransform
GdipScaleWorldTransform
GdipRotateWorldTransform
GdipGraphicsClear
GdipSetStringFormatLineAlign
GdipDrawString
GdipDeleteFont
GdipCreateFont
GdipDeleteFontFamily
GdipGetGenericFontFamilySansSerif
GdipCreateFontFamilyFromName
GdipDeletePath
GdipCreatePath
GdipDeleteStringFormat
GdipFillPath
GdipSetStringFormatAlign
GdipSaveGraphics
GdipRestoreGraphics
GdipCloneBrush
GdipCreateStringFormat
GdipDeleteBrush
GdiplusStartup
GdiplusShutdown
GdipDrawImageRectRectI
GdipDrawImagePointRectI
GdipCreateFromHDC
GdipDeleteGraphics
GdipCloneImage
GdipDrawImageRectRect
GdipSetImageAttributesColorMatrix
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipAlloc
GdipAddPathArcI
GdipFree

urlmon

URLDownloadToFileW
URLDownloadToCacheFileW

iphlpapi

GetAdaptersInfo

wininet

InternetGetConnectedState
InternetCrackUrlW
InternetOpenW
InternetConnectW
HttpOpenRequestW
HttpSendRequestW
InternetQueryOptionW
InternetSetOptionW
HttpQueryInfoW
InternetCloseHandle

netapi32

NetApiBufferFree
NetWkstaGetInfo

setupapi

SetupIterateCabinetW

ws2_32

__WSAFDIsSet
WSAGetLastError
select
recv
ioctlsocket
getaddrinfo
freeaddrinfo
WSASetLastError
socket
send
WSAIoctl
setsockopt
getsockname
ntohs
bind
htons
getsockopt
WSAStartup
connect
WSACleanup
closesocket
getpeername

Sections

.text
Size: 851KB - Virtual size: 850KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 215KB - Virtual size: 215KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 55KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7.5MB - Virtual size: 7.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f3bc7307a737af2e91a18c2deb1d81cc

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

29:5b:f8:6e:85:26:53:40:33:13:83:7bCertificate

Extended Key Usages

Key Usages

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1dCertificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fcCertificate

Key Usages

04:00:00:00:00:01:21:58:53:08:a2Certificate

Key Usages

cd:62:e7:a4:b3:47:fe:d7:00:37:80:73:f4:cc:b3:3b:6d:39:d1:f4:b9:a0:7b:8e:ab:9c:c6:da:70:a6:ec:07Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

crypt32

version

psapi

rpcrt4

gdiplus

urlmon

iphlpapi

wininet

netapi32

setupapi

ws2_32

Sections

.text Size: 851KB - Virtual size: 850KB

.rdata Size: 215KB - Virtual size: 215KB

.data Size: 55KB - Virtual size: 76KB

.rsrc Size: 7.5MB - Virtual size: 7.5MB

.reloc Size: 81KB - Virtual size: 81KB

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

29:5b:f8:6e:85:26:53:40:33:13:83:7b
Certificate

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

04:00:00:00:00:01:21:58:53:08:a2
Certificate

cd:62:e7:a4:b3:47:fe:d7:00:37:80:73:f4:cc:b3:3b:6d:39:d1:f4:b9:a0:7b:8e:ab:9c:c6:da:70:a6:ec:07
Signer

.text
Size: 851KB - Virtual size: 850KB

.rdata
Size: 215KB - Virtual size: 215KB

.data
Size: 55KB - Virtual size: 76KB

.rsrc
Size: 7.5MB - Virtual size: 7.5MB

.reloc
Size: 81KB - Virtual size: 81KB