69b3780db0598ae4cb09bbab7c4019f0b48da5445528b3c5e68a32d1056365b1

Sharing

Copy URL Twitter E-mail

General

Target

69b3780db0598ae4cb09bbab7c4019f0b48da5445528b3c5e68a32d1056365b1
Size

5.8MB
MD5

b86fc63dc5d344fae09d68d62395f41f
SHA1

a2cd7e78fc7900140f8216518865122e8ed089b6
SHA256

69b3780db0598ae4cb09bbab7c4019f0b48da5445528b3c5e68a32d1056365b1
SHA512

d8e54b1ff778cc46601c50b543fa45b5ba9aa343dcab874b1d3e319e87ffae104304c6e960ed4d2c22082006b7b2ef0df3c0e991d5c419d590f76431156ba015
SSDEEP

98304:fYwhz5FvMgtmPeVd1mMVfwh9Da5ULRETCVEn1ZttIbPQQsIXHB4TwWeMv2hOBrcM:ftDUGVWMxSE+RETn1CbhYwGv2hOBYI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
69b3780db0598ae4cb09bbab7c4019f0b48da5445528b3c5e68a32d1056365b1

Files

69b3780db0598ae4cb09bbab7c4019f0b48da5445528b3c5e68a32d1056365b1
.dll windows:5 windows x64 arch:x64

1247fa992e49182b1fb6f5d6fa2a885d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

IsDebuggerPresent
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

CharUpperBuffW

Exports

Exports

VMProtectActivateLicense
VMProtectBegin
VMProtectBeginMutation
VMProtectBeginUltra
VMProtectBeginUltraLockByKey
VMProtectBeginVirtualization
VMProtectBeginVirtualizationLockByKey
VMProtectDeactivateLicense
VMProtectDecryptStringA
VMProtectDecryptStringW
VMProtectEnd
VMProtectFreeString
VMProtectGetCurrentHWID
VMProtectGetOfflineActivationString
VMProtectGetOfflineDeactivationString
VMProtectGetSerialNumberData
VMProtectGetSerialNumberState
VMProtectIsDebuggerPresent
VMProtectIsProtected
VMProtectIsValidImageCRC
VMProtectIsVirtualMachinePresent
VMProtectSetSerialNumber

Sections

.text
Size: - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

./!w
Size: - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.][y
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.xh,
Size: 5.7MB - Virtual size: 5.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 220B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 469B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1247fa992e49182b1fb6f5d6fa2a885d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

Exports

Exports

Sections

.text Size: - Virtual size: 66KB

.rdata Size: - Virtual size: 38KB

.data Size: - Virtual size: 6KB

.pdata Size: - Virtual size: 3KB

.gfids Size: - Virtual size: 148B

./!w Size: - Virtual size: 3.3MB

.][y Size: 2KB - Virtual size: 2KB

.xh, Size: 5.7MB - Virtual size: 5.7MB

.reloc Size: 512B - Virtual size: 220B

.rsrc Size: 512B - Virtual size: 469B

.text
Size: - Virtual size: 66KB

.rdata
Size: - Virtual size: 38KB

.data
Size: - Virtual size: 6KB

.pdata
Size: - Virtual size: 3KB

.gfids
Size: - Virtual size: 148B

./!w
Size: - Virtual size: 3.3MB

.][y
Size: 2KB - Virtual size: 2KB

.xh,
Size: 5.7MB - Virtual size: 5.7MB

.reloc
Size: 512B - Virtual size: 220B

.rsrc
Size: 512B - Virtual size: 469B