External-Loader[.]vmp_1[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

External-Loader.vmp_1.exe
Size

13.9MB
MD5

99a78f9e48205490a570e9cb87819e20
SHA1

0bd215409e85b86bf69795970cb22e3846a7767c
SHA256

df1ffd001d660cd4451983f02949469c3d3eab913570907813b640f8ac0bfee7
SHA512

2dab9b389c90d959b3b4bbdb9839d9854446c04c6f66d2c1b2804a10aa28a1c44f0837ce48be650e56576fc53e2ba8eab617ece7c33a11cfdeb459e08ed9d725
SSDEEP

393216:M6qDqXFiZcZWc+c+koveWjRy09m0S5W/iH:MXqXFiW4SJoveWNy09mV5g0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
External-Loader.vmp_1.exe

Files

External-Loader.vmp_1.exe
.exe windows:6 windows x64 arch:x64

bd2652280d0a956596540bf0c8af75da

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

FillConsoleOutputAttribute

user32

GetDC

gdi32

BitBlt

advapi32

ConvertSidToStringSidA

msvcp140

?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcmp

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table

api-ms-win-crt-heap-l1-1-0

_set_new_mode

api-ms-win-crt-utility-l1-1-0

srand

api-ms-win-crt-stdio-l1-1-0

fclose

api-ms-win-crt-convert-l1-1-0

strtoll

api-ms-win-crt-string-l1-1-0

isdigit

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-filesystem-l1-1-0

_lock_file

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func

api-ms-win-crt-math-l1-1-0

ceilf

Sections

.text
Size: 212KB - Virtual size: 212KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 429KB - Virtual size: 433KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.x<`
Size: 6.5MB - Virtual size: 6.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.Go!
Size: 512B - Virtual size: 336B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ajC
Size: 6.7MB - Virtual size: 6.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 876B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bd2652280d0a956596540bf0c8af75da

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

Sections

.text Size: 212KB - Virtual size: 212KB

.rdata Size: 36KB - Virtual size: 35KB

.data Size: 429KB - Virtual size: 433KB

.pdata Size: 7KB - Virtual size: 6KB

.x<` Size: 6.5MB - Virtual size: 6.5MB

.Go! Size: 512B - Virtual size: 336B

.ajC Size: 6.7MB - Virtual size: 6.7MB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 1024B - Virtual size: 876B

.text
Size: 212KB - Virtual size: 212KB

.rdata
Size: 36KB - Virtual size: 35KB

.data
Size: 429KB - Virtual size: 433KB

.pdata
Size: 7KB - Virtual size: 6KB

.x<`
Size: 6.5MB - Virtual size: 6.5MB

.Go!
Size: 512B - Virtual size: 336B

.ajC
Size: 6.7MB - Virtual size: 6.7MB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 1024B - Virtual size: 876B