b31e5b568c22acee9a33fad15564995efa983112d7927745b96e182e9b77a9b4

Sharing

Copy URL

Twitter E-mail

General

Target

b31e5b568c22acee9a33fad15564995efa983112d7927745b96e182e9b77a9b4
Size

5.9MB
MD5

7164b6778fed75794ca5d323e50ee118
SHA1

e025de4ffb418effbc202c7007ee6f6648027571
SHA256

b31e5b568c22acee9a33fad15564995efa983112d7927745b96e182e9b77a9b4
SHA512

0c17054ff4dd9c4d14944729238b6bc5caade16e11e26b6891bfd1ae95fd422b30188ff0951e9388f98a59b5ddf1db3139b59d12ad71b0a05be29a0db073f1a7
SSDEEP

98304:/c1uClL+Vfx4vVOpnEej8V0KfT1YEnyXEwqrAfwWOpOD7mr00rydmY3O0jeVfaYC:IDL+Vfxy0ExV/rPyX1JwlpgM0uydj3Oo

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

b31e5b568c22acee9a33fad15564995efa983112d7927745b96e182e9b77a9b4
.exe windows:5 windows x64 arch:x64

d74a9a697edde053db3dd0f48ede3e46

Code Sign

61:08:77:5f:00:00:00:00:00:4a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/07/2010, 22:53

Not After

19/10/2011, 22:53

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:04:b3:f5:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:13

Not After

25/07/2011, 19:23

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:9E78-864B-039D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:15:08:27:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

25/01/2006, 23:22

Not After

25/01/2017, 23:32

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

b3:e1:23:00:83:9c:47:c1:2d:28:8d:3a:c6:5c:d1:3d:58:1c:b8:55
Signer

Actual PE Digest

b3:e1:23:00:83:9c:47:c1:2d:28:8d:3a:c6:5c:d1:3d:58:1c:b8:55

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

CryptSetHashParam
A_SHAFinal

cabinet

ord11

crypt32

CryptSignAndEncodeCertificate

cryptdll

MD5Init

dnsapi

DnsFree

fltlib

FilterFindFirst

mpr

WNetCancelConnection2W

netapi32

NetStatisticsGet
I_NetServerAuthenticate2

odbc32

ord75

ole32

CoInitializeEx

oleaut32

SysAllocString

rpcrt4

RpcBindingFree

shlwapi

UrlUnescapeW

samlib

SamEnumerateAliasesInDomain

secur32

FreeContextBuffer

shell32

CommandLineToArgvW

user32

SetClipboardViewer
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW

userenv

DestroyEnvironmentBlock

version

VerQueryValueW

hid

HidD_GetFeature

setupapi

SetupDiGetDeviceInterfaceDetailW

winscard

SCardReleaseContext

winsta

WinStationCloseServer

wldap32

ord36

msasn1

ASN1_CreateModule

ntdll

strtol

kernel32

GetVersionExW
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

msvcrt

calloc

wtsapi32

WTSSendMessageW

Sections

.text
Size: - Virtual size: 829KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 413KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 3.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 5.9MB - Virtual size: 5.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 180B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d74a9a697edde053db3dd0f48ede3e46

Code Sign

61:08:77:5f:00:00:00:00:00:4aCertificate

Extended Key Usages

Key Usages

61:04:b3:f5:00:00:00:00:00:0dCertificate

Extended Key Usages

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

61:15:08:27:00:00:00:00:00:0cCertificate

Extended Key Usages

Key Usages

b3:e1:23:00:83:9c:47:c1:2d:28:8d:3a:c6:5c:d1:3d:58:1c:b8:55Signer

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

cabinet

crypt32

cryptdll

dnsapi

fltlib

mpr

netapi32

odbc32

ole32

oleaut32

rpcrt4

shlwapi

samlib

secur32

shell32

user32

userenv

version

hid

setupapi

winscard

winsta

wldap32

msasn1

ntdll

kernel32

msvcrt

wtsapi32

Sections

.text Size: - Virtual size: 829KB

.rdata Size: - Virtual size: 413KB

.data Size: - Virtual size: 30KB

.pdata Size: - Virtual size: 26KB

.vmp0 Size: - Virtual size: 3.6MB

.vmp1 Size: 5.9MB - Virtual size: 5.9MB

.reloc Size: 512B - Virtual size: 180B

.rsrc Size: 12KB - Virtual size: 12KB

61:08:77:5f:00:00:00:00:00:4a
Certificate

61:04:b3:f5:00:00:00:00:00:0d
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

61:15:08:27:00:00:00:00:00:0c
Certificate

b3:e1:23:00:83:9c:47:c1:2d:28:8d:3a:c6:5c:d1:3d:58:1c:b8:55
Signer

.text
Size: - Virtual size: 829KB

.rdata
Size: - Virtual size: 413KB

.data
Size: - Virtual size: 30KB

.pdata
Size: - Virtual size: 26KB

.vmp0
Size: - Virtual size: 3.6MB

.vmp1
Size: 5.9MB - Virtual size: 5.9MB

.reloc
Size: 512B - Virtual size: 180B

.rsrc
Size: 12KB - Virtual size: 12KB