TPM[.]rar | Triage

Sharing

Copy URL Twitter E-mail

General

Target

TPM.rar
Size

14.1MB
MD5

11f9c3ccc513305535caafe4627d4a68
SHA1

8d975718030d77803ca2ac897d9005fe3c967d67
SHA256

d2065273dcfb85695667ec6d3af54f7881f00d744397b59e57198984713ee78b
SHA512

ade9381e26a9b51c7b86d035035180f3bd79a334668ca25e24b75a3de675ad7afaa1374281c7a0a22bb6d52a2ecf57067ca407d74b8d01dd550b2e1cfd6e137e
SSDEEP

393216:o4OplJ3guoMabT3eFYH4uFJIrLG4V42tUV1K3kO/0p8:EnJQgqzeaH4WJZ2+1KUS+8

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/DB0F27CA4C6.exe
unpack001/VMProtectSDK64.dll

Files

TPM.rar
.rar
DB0F27CA4C6.exe
.exe windows:6 windows x64 arch:x64

269a3a5a5bc0f5bc811506f5d078dc89

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\LWAY\Desktop\lawyS\x64\Release\FreeLway.pdb

Imports

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
NtSetInformationThread
VerSetConditionMask

setupapi

SetupDiGetDeviceInstanceIdA
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetClassDevsA

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

kernel32

K32EnumProcessModules
DebugBreak
LocalAlloc
lstrcmpA
CreateFileA
GetCurrentThread
WaitForSingleObject
CreateProcessA
ReadFile
Thread32Next
Thread32First
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
OpenThread
GetFileAttributesA
GetSystemInfo
ReadProcessMemory
VirtualQuery
LeaveCriticalSection
FormatMessageA
GetFileSizeEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetSystemTimeAsFileTime
InitializeSListHead
K32EnumProcesses
InitOnceComplete
InitOnceBeginInitialize
OutputDebugStringW
QueryFullProcessImageNameW
GetModuleHandleW
SleepEx
GetSystemDirectoryA
GetCurrentThreadId
DeleteCriticalSection
CloseHandle
GetLastError
Sleep
UnmapViewOfFile
CreateFileW
InitializeCriticalSectionEx
GetCurrentProcess
VirtualProtect
GetModuleFileNameA
GlobalUnlock
WideCharToMultiByte
GlobalLock
LocalFree
OpenProcess
GetCurrentProcessId
GlobalFree
GlobalAlloc
QueryPerformanceCounter
FreeLibrary
GetProcAddress
GetConsoleWindow
Beep
QueryPerformanceFrequency
LoadLibraryA
MultiByteToWideChar
GetLocaleInfoA
GetModuleHandleA
VerifyVersionInfoA
GetTickCount
MoveFileExA
WaitForSingleObjectEx
K32GetModuleFileNameExW
GetTickCount64
MapViewOfFile
CreateFileMappingW
GetEnvironmentVariableA
GetStdHandle
GetFileType
PeekNamedPipe
WaitForMultipleObjects
SetLastError
EnterCriticalSection

user32

CreateWindowExA
PeekMessageA
DefWindowProcA
FindWindowExA
PostMessageA
UnregisterClassA
GetWindowLongA
EnumWindows
IsWindowVisible
GetWindowThreadProcessId
FindWindowA
DispatchMessageA
TranslateMessage
GetWindowRect
ReleaseCapture
IsWindowUnicode
GetClientRect
SetCursor
SetCapture
GetForegroundWindow
GetKeyboardLayout
TrackMouseEvent
ClientToScreen
GetCapture
ScreenToClient
LoadCursorA
GetMessageExtraInfo
GetKeyState
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
SetLayeredWindowAttributes
UpdateWindow
RegisterClassExA
DestroyWindow
PostQuitMessage
GetSystemMetrics
ShowWindow
GetAsyncKeyState
SetCursorPos
MoveWindow
GetCursorPos

advapi32

CryptEncrypt
CryptReleaseContext
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegGetValueA
RegCloseKey
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptHashData
RegQueryValueExA
RegSetValueExW
CryptDestroyHash
CryptDestroyKey
CryptImportKey
RegCreateKeyExW
OpenServiceA
QueryServiceStatusEx
OpenProcessToken
OpenSCManagerA
CryptAcquireContextA
LookupPrivilegeValueA
CloseServiceHandle
RegOpenKeyExW
RegQueryValueExW
AdjustTokenPrivileges

shell32

SHGetFolderPathW
ShellExecuteA

vmprotectsdk64

VMProtectBeginUltra
VMProtectEnd

d3dcompiler_43

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

msvcp140

??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
_Query_perf_frequency
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Throw_Cpp_error@std@@YAXH@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?uncaught_exception@std@@YA_NXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?_Random_device@std@@YAIXZ
_Mtx_destroy_in_situ
_Mtx_init_in_situ
_Cnd_do_broadcast_at_thread_exit
_Query_perf_counter
_Thrd_detach
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?good@ios_base@std@@QEBA_NXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ

d3d11

D3D11CreateDeviceAndSwapChain

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

imm32

ImmReleaseContext
ImmSetCandidateWindow
ImmGetContext
ImmSetCompositionWindow

normaliz

IdnToAscii

wldap32

ord143
ord217
ord46
ord211
ord60
ord45
ord301
ord200
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord22
ord41
ord50

crypt32

CertFreeCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CryptDecodeObjectEx
CertAddCertificateContextToStore
PFXImportCertStore
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertFindExtension
CertOpenStore
CertGetNameStringW
CertCloseStore
CertEnumCertificatesInStore
CertGetCertificateChain

ws2_32

WSAGetLastError
getpeername
bind
connect
getsockname
gethostname
inet_ntoa
getsockopt
htons
ntohl
sendto
recvfrom
freeaddrinfo
getaddrinfo
select
__WSAFDIsSet
WSAStartup
gethostbyname
ntohs
ioctlsocket
listen
htonl
accept
recv
WSACleanup
WSAIoctl
WSASetLastError
closesocket
socket
setsockopt
send

shlwapi

PathRemoveFileSpecA
StrStrW

rpcrt4

UuidToStringA
RpcStringFreeA
UuidCreate

iphlpapi

GetIfEntry
GetIpForwardTable

winmm

PlaySoundA

mpr

WNetGetProviderNameA

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception
__C_specific_handler
memchr
__current_exception_context
memcmp
memmove
__std_terminate
__std_exception_destroy
__std_exception_copy
strstr
wcsstr
memcpy
memset
strchr
strrchr
_CxxThrowException

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf
fwrite
_wfopen
fclose
__stdio_common_vsprintf
fflush
fread
__stdio_common_vsscanf
__acrt_iob_func
_lseeki64
_open
_close
_pclose
_write
feof
fputs
fopen
_read
getchar
fgets
ftell
fgetws
_wpopen
__stdio_common_vsprintf_s
_popen
__stdio_common_vfwprintf
fputc
_get_stream_buffer_pointers
_fseeki64
fsetpos
ungetc
__p__commode
setvbuf
fgetpos
_set_fmode
fseek
fgetc

api-ms-win-crt-utility-l1-1-0

qsort
srand
rand

api-ms-win-crt-string-l1-1-0

_strdup
strncpy_s
strncpy
isupper
tolower
isspace
toupper
strpbrk
strspn
strncmp
strcmp
strcspn

api-ms-win-crt-heap-l1-1-0

_callnewh
malloc
realloc
free
calloc
_set_new_mode

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e
_exit
terminate
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_set_app_type
_seh_filter_exe
_beginthreadex
_errno
abort
strerror
_cexit
exit
_invalid_parameter_noinfo_noreturn
_crt_atexit
_getpid
__sys_nerr
_register_onexit_function
_get_initial_narrow_environment
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
system

api-ms-win-crt-convert-l1-1-0

strtoul
strtol
strtoull
strtoll
atoi
strtod
wcstombs_s

api-ms-win-crt-locale-l1-1-0

localeconv
_configthreadlocale

api-ms-win-crt-time-l1-1-0

_time64
_gmtime64

api-ms-win-crt-filesystem-l1-1-0

_lock_file
remove
_unlock_file
rename
_fstat64
_stat64
_access
_unlink

api-ms-win-crt-math-l1-1-0

sinf
pow
fmodf
sqrtf
_dclass
acosf
ceilf
cosf
__setusermatherr

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 217KB - Virtual size: 217KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21.0MB - Virtual size: 21.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
READ ME.txt
VMProtectSDK64.dll
.dll windows:5 windows x64 arch:x64

1851ff453adce0cef5274e320d5bed3c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

IsDebuggerPresent
GetLocalTime
GetTickCount
GetModuleFileNameW
GetPrivateProfileStringW
MultiByteToWideChar
WideCharToMultiByte
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
InterlockedFlushSList
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
HeapFree
HeapAlloc
GetStringTypeW
GetACP
GetStdHandle
GetFileType
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetStdHandle
HeapSize
HeapReAlloc
GetConsoleMode
FlushFileBuffers
WriteFile
GetConsoleCP
SetFilePointerEx
CloseHandle
WriteConsoleW
CreateFileW
RaiseException

Exports

Exports

VMProtectActivateLicense
VMProtectBegin
VMProtectBeginMutation
VMProtectBeginUltra
VMProtectBeginUltraLockByKey
VMProtectBeginVirtualization
VMProtectBeginVirtualizationLockByKey
VMProtectDeactivateLicense
VMProtectDecryptStringA
VMProtectDecryptStringW
VMProtectEnd
VMProtectFreeString
VMProtectGetCurrentHWID
VMProtectGetOfflineActivationString
VMProtectGetOfflineDeactivationString
VMProtectGetSerialNumberData
VMProtectGetSerialNumberState
VMProtectIsDebuggerPresent
VMProtectIsProtected
VMProtectIsValidImageCRC
VMProtectIsVirtualMachinePresent
VMProtectSetSerialNumber

Sections

.text
Size: 67KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

269a3a5a5bc0f5bc811506f5d078dc89

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntdll

setupapi

version

kernel32

user32

advapi32

shell32

vmprotectsdk64

d3dcompiler_43

dwmapi

msvcp140

d3d11

d3dx11_43

imm32

normaliz

wldap32

crypt32

ws2_32

shlwapi

rpcrt4

iphlpapi

winmm

mpr

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 217KB - Virtual size: 217KB

.data Size: 21.0MB - Virtual size: 21.0MB

.pdata Size: 35KB - Virtual size: 34KB

.rsrc Size: 512B - Virtual size: 488B

.reloc Size: 2KB - Virtual size: 2KB

1851ff453adce0cef5274e320d5bed3c

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 67KB - Virtual size: 66KB

.rdata Size: 39KB - Virtual size: 38KB

.data Size: 2KB - Virtual size: 6KB

.pdata Size: 4KB - Virtual size: 3KB

.gfids Size: 512B - Virtual size: 148B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 217KB - Virtual size: 217KB

.data
Size: 21.0MB - Virtual size: 21.0MB

.pdata
Size: 35KB - Virtual size: 34KB

.rsrc
Size: 512B - Virtual size: 488B

.reloc
Size: 2KB - Virtual size: 2KB

.text
Size: 67KB - Virtual size: 66KB

.rdata
Size: 39KB - Virtual size: 38KB

.data
Size: 2KB - Virtual size: 6KB

.pdata
Size: 4KB - Virtual size: 3KB

.gfids
Size: 512B - Virtual size: 148B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 2KB - Virtual size: 1KB