VMPDump[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

VMPDump.exe
Size

14.0MB
MD5

711909ae32e6bebfe5f54336299c03ab
SHA1

65502a98579a6d38f2f7447f3962d25fa53c4b1d
SHA256

b20bd2523d7b58b76d25c941db391038879c89b33f463f5ec136fcc5a3503e6d
SHA512

43f03076874ac60d7aac3337ba638f9d41807ecb6af85b04ea5f82257bf0e5fb03604b15bc8a909e79e43cfdf08d1cf3b77584c4ad653fef932c99a8238ae3db
SSDEEP

98304:9v8N5TQ6Z/TrttoEHaeYNuhAk8oIk8w0csPaDBcWDaW5Tkkk:9v8N5TQ+Tr4EHlEu8Tkk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
VMPDump.exe

Files

VMPDump.exe
.exe windows:6 windows x64 arch:x64

048cdc0078eb5af6e8701f1f001503ca

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\adamn\Documents\GitHub\vmpdump\x64\Release\VMPDump.pdb

Imports

kernel32

OpenProcess
CloseHandle
ReadProcessMemory
QueryFullProcessImageNameA
K32GetModuleBaseNameA
K32GetModuleInformation
K32EnumProcessModules
IsBadReadPtr
FormatMessageA
LocalFree
WideCharToMultiByte
MultiByteToWideChar
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
VirtualQuery
GetSystemInfo
GetLastError
GetFileType
GetFileInformationByHandle
GetFileAttributesW
CreateFileW
GetCurrentDirectoryW
VerifyVersionInfoW
VerSetConditionMask
SetConsoleTextAttribute
SetConsoleOutputCP
GetStdHandle
AreFileApisANSI
GetModuleHandleW
GetProcAddress
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead

shlwapi

PathFindFileNameA

msvcp140

?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Xbad_function_call@std@@YAXXZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z
?_Random_device@std@@YAIXZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
?_Xlength_error@std@@YAXPEBD@Z
_Mtx_destroy_in_situ
??Bid@locale@std@@QEAA_KXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
_Mtx_init_in_situ
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Xbad_alloc@std@@YAXXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Winerror_map@std@@YAHH@Z
?_Throw_C_error@std@@YAXH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Syserror_map@std@@YAPEBDH@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
_Mtx_lock
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
_Mtx_unlock
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_copy
__std_exception_destroy
__std_terminate
__current_exception_context
__C_specific_handler
memchr
_purecall
memcmp
strchr
strrchr
strstr
memset
memmove
memcpy
_CxxThrowException
__current_exception

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf
__acrt_iob_func
fclose
_read
_close
_write
_lseek
__p__commode
_set_fmode
fgetc
putchar
fwrite
fgetpos
_open_osfhandle
_get_osfhandle
fputs
setvbuf
ungetc
_isatty
fsetpos
fread
__stdio_common_vsprintf
fputc
_fseeki64
_get_stream_buffer_pointers
fflush

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe
terminate
exit
_cexit
_errno
_register_onexit_function
_set_app_type
_crt_atexit
_initialize_onexit_table
abort
_get_initial_narrow_environment
_initterm
_configure_narrow_argv
_initterm_e
_exit
__p___argc
__p___argv
_c_exit
_invalid_parameter_noinfo_noreturn
_register_thread_local_exe_atexit_callback
_initialize_narrow_environment

api-ms-win-crt-heap-l1-1-0

_set_new_mode
realloc
free
malloc
calloc
_callnewh
_aligned_free
_aligned_malloc

api-ms-win-crt-filesystem-l1-1-0

_lock_file
_unlock_file

api-ms-win-crt-string-l1-1-0

strncmp
isdigit
isalnum
strncpy
isalpha
isxdigit
isupper
islower
toupper
isspace
_stricmp
tolower

api-ms-win-crt-math-l1-1-0

__setusermatherr
sqrt
_fpclass
ceilf

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func
_configthreadlocale

Sections

.text
Size: 5.5MB - Virtual size: 5.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7.3MB - Virtual size: 7.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1010KB - Virtual size: 15.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 103KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 122KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

048cdc0078eb5af6e8701f1f001503ca

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

shlwapi

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 5.5MB - Virtual size: 5.5MB

.rdata Size: 7.3MB - Virtual size: 7.3MB

.data Size: 1010KB - Virtual size: 15.3MB

.pdata Size: 103KB - Virtual size: 103KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 122KB - Virtual size: 121KB

.text
Size: 5.5MB - Virtual size: 5.5MB

.rdata
Size: 7.3MB - Virtual size: 7.3MB

.data
Size: 1010KB - Virtual size: 15.3MB

.pdata
Size: 103KB - Virtual size: 103KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 122KB - Virtual size: 121KB