General

  • Target

    VMFS_Recovery.exe

  • Size

    48.2MB

  • MD5

    c89ba2ec32d1e45808c324a271ae99d9

  • SHA1

    b37dcc340a65b6e6aa2a0c4e84631fb2a930933d

  • SHA256

    411c917f6338e6126787d7e5ecc318913581fb5a2bfc5d0548eb0b41e3b3af7a

  • SHA512

    bad604b496842e109279b2942a556b46a367332ee6a5c0c6190a7ea5d914dcf5cea2737ecf5fbf38340dd4c38cdbaff13de9e289d4e27b3e5231ad4e66a67a28

  • SSDEEP

    1572864:XdkHfj/WgbPIpM/RWVBltvQW3dIXsCF1zyISuxtxVZ1tw:XdIjVIpoYBgW3W8CF1zyIvtxLw

Score
7/10

Malware Config

Signatures

  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • VMFS_Recovery.exe
    .exe windows:4 windows x86 arch:x86

    f4639a0b3116c2cfc71144b88a929cfd


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    509a34b3a68a773e0afb4259e68f9f82


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    3b477381217c97b22146297f93df2a92


    Headers

    Imports

    Exports

    Sections

  • DiskInternals.Preview.dll
    .exe windows:5 windows x86 arch:x86

    4e65df08a08f1fb10440869399f9d808


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • License.txt
  • av/SDL2.dll
    .dll windows:4 windows x86 arch:x86

    907496b88ebc992364a5a4373ee3f21e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • av/SoundTouch.dll
    .dll windows:4 windows x86 arch:x86

    47c48064dbc000892407135387cfad7a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • av/avcodec-58.dll
    .dll windows:4 windows x86 arch:x86

    cd0a5ed988fad37163c8ee72c4762a70


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • av/avdevice-58.dll
    .dll windows:4 windows x86 arch:x86

    0f2ed6f29fbeb4e03beb0eeb2b3469b5


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • av/avfilter-7.dll
    .dll windows:4 windows x86 arch:x86

    271f6870a95dccb0d06490dd0ffa6103


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • av/avformat-58.dll
    .dll windows:4 windows x86 arch:x86

    89915f8168713efa6372bd1964165acb


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • av/avutil-56.dll
    .dll windows:4 windows x86 arch:x86

    483bbb94eef2f764360d3c98297ea267


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • av/swresample-3.dll
    .dll windows:4 windows x86 arch:x86

    9ad731d37d3ea2f838d63d288fa8c273


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • av/swscale-5.dll
    .dll windows:4 windows x86 arch:x86

    4545c0140d8a26dbcf1e58ac66be2d47


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • b64.dll
    .dll windows:6 windows x64 arch:x64

    bcf0c2f3d39c34f50899f10439f86703


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • cbfs.cab
    .cab
  • cbfsconnectevtmsg.dll
    .dll windows:5 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • i386/SHA1/cbfsconnect2017.sys
    .sys windows:6 windows x86 arch:x86

    5d28e7aceab7e2ae7853d717a86cee9c


    Code Sign

    Headers

    Imports

    Sections

  • i386/SHA1/vpnpbus.cat
  • i386/SHA1/vpnpbus.inf
  • i386/SHA1/vpnpbus.sys
    .sys windows:6 windows x86 arch:x86

    b0da1bc6851e0bc1f3c297f207acc85b


    Code Sign

    Headers

    Imports

    Sections

  • i386/cbfsconnect2017.sys
    .sys windows:6 windows x86 arch:x86

    5d28e7aceab7e2ae7853d717a86cee9c


    Code Sign

    Headers

    Imports

    Sections

  • i386/cbfsconnectMntNtf2017.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    bacbf68d798faeba4ee2e76f30d65fdc


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • i386/cbfsconnectNetRdr2017.dll
    .dll windows:5 windows x86 arch:x86

    2b81fb4b58098cec4efe46553a5da16e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • i386/vpnpbus.cat
  • i386/vpnpbus.inf
  • i386/vpnpbus.sys
    .sys windows:6 windows x86 arch:x86

    b0da1bc6851e0bc1f3c297f207acc85b


    Code Sign

    Headers

    Imports

    Sections

  • ia64/SHA1/cbfsconnect2017.sys
  • ia64/SHA1/vpnpbus.cat
  • ia64/SHA1/vpnpbus.inf
  • ia64/SHA1/vpnpbus.sys
  • ia64/cbfsconnectMntNtf2017.dll
  • ia64/cbfsconnectNetRdr2017.dll
  • wow64sup.exe
    .exe windows:5 windows x64 arch:x64

    2883b16fadf02f033c0bb617ed7b8030


    Code Sign

    Headers

    Imports

    Sections

  • x64/SHA1/cbfsconnect2017.sys
    .sys windows:6 windows x64 arch:x64

    02ede98ea4c0581568dcadee85bd5e94


    Code Sign

    Headers

    Imports

    Sections

  • x64/SHA1/vpnpbus.cat
  • x64/SHA1/vpnpbus.inf
  • x64/SHA1/vpnpbus.sys
    .sys windows:6 windows x64 arch:x64

    c6197237988fbc167f360d26ca736f7c


    Code Sign

    Headers

    Imports

    Sections

  • x64/cbfsconnect2017.sys
    .sys windows:6 windows x64 arch:x64

    02ede98ea4c0581568dcadee85bd5e94


    Code Sign

    Headers

    Imports

    Sections

  • x64/cbfsconnectMntNtf2017.dll
    .dll regsvr32 windows:5 windows x64 arch:x64

    320a9c93f519f83dd2b9d2c5f85044e0


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • x64/cbfsconnectNetRdr2017.dll
    .dll windows:5 windows x64 arch:x64

    411249db573fa4cd403ea4fc200a9321


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • x64/vpnpbus.cat
  • x64/vpnpbus.inf
  • x64/vpnpbus.sys
    .sys windows:6 windows x64 arch:x64

    c6197237988fbc167f360d26ca736f7c


    Code Sign

    Headers

    Imports

    Sections

  • cbfs64.dll
    .dll windows:5 windows x64 arch:x64

    5d74610b714e149e647f4740c17a33f4


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • fat12.dll
    .dll windows:5 windows x86 arch:x86

    4d16433f8cba350153114f9a47c0f85f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • fat16.dll
    .dll windows:5 windows x64 arch:x64

    6f82bfce659ea15e1597d479240032b5


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • fsm.ini
  • ippcp.dll
    .dll windows:6 windows x64 arch:x64

    07b48281775ec08a0602a20a04cfc132


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • jt.dll
    .dll windows:5 windows x86 arch:x86

    fa19e76d26017b15d845e5fffdf92290


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • libraw.dll
    .dll windows:5 windows x86 arch:x86

    9047f2776af334f6d428227d3eedc138


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • nas32.dll
    .dll windows:6 windows x86 arch:x86

    c09772544c19d690442a3f7954078cd9


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • nas64.dll
    .dll windows:6 windows x64 arch:x64

    87b12ced34dd62d8eca9e2880b38b414


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • vmfs_recovery.exe
    .exe windows:5 windows x86 arch:x86

    bbf66a06563977faab758074644d12ea


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • vmfs_recovery64.exe
    .exe windows:5 windows x64 arch:x64

    0b0e1f713f0c046da534a2936ac6e89f


    Code Sign

    Headers

    Imports

    Exports

    Sections