21f247c6c84b114525d41500d54a63ab4bcea96d14ba8ca13be445acd72a081d[.]exe | Triage

Sharing

General

Target

21f247c6c84b114525d41500d54a63ab4bcea96d14ba8ca13be445acd72a081d.exe
Size

5.5MB
MD5

0b4ad1c3b3f364c3d79fabdb47fe3385
SHA1

85de5462d6342f03eaf3fb48176615fa6fa18508
SHA256

21f247c6c84b114525d41500d54a63ab4bcea96d14ba8ca13be445acd72a081d
SHA512

c9f6ecb99786613113ae5e02bf9e4a00fcf7036a1bddd07c87f8cb66ce8f45b9515d4fc0321cbf20282556f16645818249d04390335f518afdc1d2253f8dab76
SSDEEP

98304:ao3n7Qvg+PVALF8Ka+EQLkVBbrxkKmrMP2tOmzprZOCgNYWxMuxee4F6OzU7+bgb:aY84EALF8Ka+EUakLrMP2tDrQCg6Wxj5

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs
Detects executables packed with VMProtect commercial packer.
vmprotect

Processes:

resource yara_rule

sample vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
21f247c6c84b114525d41500d54a63ab4bcea96d14ba8ca13be445acd72a081d.exe

Files

21f247c6c84b114525d41500d54a63ab4bcea96d14ba8ca13be445acd72a081d.exe
.exe windows:6 windows x86 arch:x86

d435064ba91569f26a23505d954231af

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

oleaut32

SysAllocString

ole32

CoCreateInstance

user32

CloseClipboard
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW

gdi32

BitBlt

wtsapi32

WTSSendMessageW

Sections

.text
Size: - Virtual size: 228KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 5.5MB - Virtual size: 5.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ