7c179f962ec2e24b92f55b37933e8c0d64d13166d5a97353fe095540efb7f6e5

Sharing

Copy URL Twitter E-mail

General

Target
7c179f962ec2e24b92f55b37933e8c0d64d13166d5a97353fe095540efb7f6e5
Size 1.5MB
Sample240613-d6bd1ashla
SHA256 7c179f962ec2e24b92f55b37933e8c0d64d13166d5a97353fe095540efb7f6e5
MD5 3d753ff9d0e60300c7d270907094ea94
SHA1 ff54f82c1d07999341e62cb678f19506f66fd499
SHA512 63e30d69945262c2d734cd2feb5ad68fdb12baa36d14532299704f504b840d261be05ac20360c2e0780d7742f805a737b727e2acf5721ab4168a0b685105807b
SSDEEP 24576:G8bzNEkSz7fjxMexd7oeirdD/ONyWxOHV6uwS6ULArf7ok4Rsoyl6j/0CFPqxGqI:1IjCTl2WlwSXRumqnO6hDg
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7c179f962ec2e24b92f55b37933e8c0d64d13166d5a97353fe095540efb7f6e5

File Explorer

7c179f962ec2e24b92f55b37933e8c0d64d13166d5a97353fe095540efb7f6e5

.exe 1.5MB

7c179f962ec2e24b92f55b37933e8c0d64d13166d5a97353fe095540efb7f6e5

IMPHASH 356644ae5ef61646b770db557e4a582f
SHA256 7c179f962ec2e24b92f55b37933e8c0d64d13166d5a97353fe095540efb7f6e5
MD5 3d753ff9d0e60300c7d270907094ea94
SHA1 ff54f82c1d07999341e62cb678f19506f66fd499
SHA512 63e30d69945262c2d734cd2feb5ad68fdb12baa36d14532299704f504b840d261be05ac20360c2e0780d7742f805a737b727e2acf5721ab4168a0b685105807b
SSDEEP 24576:G8bzNEkSz7fjxMexd7oeirdD/ONyWxOHV6uwS6ULArf7ok4Rsoyl6j/0CFPqxGqI:1IjCTl2WlwSXRumqnO6hDg
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4785682

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvfw32

DrawDibDraw

avifil32

AVIStreamInfoA AVIStreamGetFrame

rasapi32

RasHangUpA RasGetConnectStatusA

iphlpapi

GetAdaptersInfo

winmm

waveOutRestart midiStreamRestart midiStreamClose midiOutReset midiStreamStop PlaySoundA waveOutUnprepareHeader waveOutPrepareHeader waveOutWrite waveOutPause waveOutReset waveOutClose midiStreamOut midiOutPrepareHeader midiStreamProperty midiStreamOpen midiOutUnprepareHeader waveOutOpen waveOutGetNumDevs

ws2_32

gethostname inet_addr inet_ntoa gethostbyname WSAStartup WSACleanup select send closesocket WSAAsyncSelect htons bind htonl socket recvfrom ioctlsocket connect recv listen getpeername WSAGetLastError __WSAFDIsSet ntohs getsockname shutdown ntohl accept

kernel32

GetWindowsDirectoryA LoadLibraryExA QueryPerformanceFrequency QueryPerformanceCounter GetVersion MapViewOfFile CreateFileMappingA LocalFree UnmapViewOfFile FormatMessageA IsDBCSLeadByte lstrcmpA lstrcmpiA lstrcpynA FileTimeToLocalFileTime GetFileType DuplicateHandle SystemTimeToFileTime GetLocalTime DosDateTimeToFileTime SetFileTime CreateMutexA ReleaseMutex SuspendThread InterlockedIncrement InterlockedDecrement FlushFileBuffers LockFile UnlockFile SetEndOfFile GlobalDeleteAtom GlobalFindAtomA GlobalAddAtomA GlobalGetAtomNameA LocalAlloc TlsAlloc GlobalHandle TlsFree TlsSetValue LocalReAlloc TlsGetValue GetFileTime GetCurrentThread GlobalFlags SetErrorMode GetProcessVersion GetCPInfo GetOEMCP GetStartupInfoA RtlUnwind GetSystemTime RaiseException ExitThread HeapSize GetACP SetStdHandle UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStdHandle GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree SetEnvironmentVariableA LCMapStringA LCMapStringW VirtualAlloc IsBadWritePtr GetStringTypeA GetStringTypeW SetUnhandledExceptionFilter CompareStringA CompareStringW IsBadReadPtr IsBadCodePtr TerminateProcess GetCurrentProcess GetFileSize SetFilePointer SetLastError GetTimeZoneInformation FileTimeToSystemTime TerminateThread CreateSemaphoreA ResumeThread ReleaseSemaphore EnterCriticalSection LeaveCriticalSection GetProfileStringA WriteFile WaitForMultipleObjects CreateFileA DeviceIoControl SetEvent FindResourceA LoadResource LockResource ReadFile lstrlenW GetModuleFileNameA WideCharToMultiByte MultiByteToWideChar GetCurrentThreadId ExitProcess GlobalSize GlobalFree DeleteCriticalSection InitializeCriticalSection lstrcatA lstrlenA WinExec lstrcpyA FindNextFileA GlobalReAlloc HeapFree HeapReAlloc GetProcessHeap HeapAlloc GetUserDefaultLCID GetFullPathNameA FreeLibrary LoadLibraryA GetLastError GetVersionExA WritePrivateProfileStringA GetPrivateProfileStringA CreateThread CreateEventA Sleep GlobalAlloc GlobalLock GlobalUnlock FindFirstFileA FindClose SetFileAttributesA GetFileAttributesA MoveFileA DeleteFileA CreateDirectoryA SetCurrentDirectoryA GetVolumeInformationA GetModuleHandleA GetProcAddress MulDiv GetCommandLineA GetTickCount CreateProcessA WaitForSingleObject CloseHandle InterlockedExchange Beep GetModuleFileNameW GetModuleHandleA LoadLibraryA LocalAlloc LocalFree GetModuleFileNameA ExitProcess

user32

ScrollWindowEx IsDialogMessageA CheckMenuItem SetMenuItemBitmaps GetMenuCheckMarkDimensions GetSysColorBrush MoveWindow CallWindowProcA SetPropA DrawTextA GetCursor DrawStateA FrameRect GetNextDlgTabItem LoadIconA TranslateMessage DrawFrameControl DrawEdge DrawFocusRect WindowFromPoint GetMessageA DispatchMessageA SetRectEmpty RegisterClipboardFormatA CreateIconFromResourceEx CreateIconFromResource DrawIconEx CreatePopupMenu AppendMenuA ModifyMenuA CreateMenu CreateAcceleratorTableA GetDlgCtrlID GetSubMenu EnableMenuItem ClientToScreen EnumDisplaySettingsA LoadImageA SystemParametersInfoA ShowWindow IsWindowEnabled TranslateAcceleratorA GetKeyState CopyAcceleratorTableA PostQuitMessage IsZoomed GetClassInfoA DefWindowProcA GetSystemMenu DeleteMenu GetMenu SetMenu PeekMessageA GetMessageTime SetFocus GetActiveWindow GetWindow DestroyAcceleratorTable SetWindowRgn GetMessagePos ScreenToClient ChildWindowFromPointEx CopyRect LoadBitmapA WinHelpA KillTimer SetTimer ReleaseCapture GetCapture SetCapture GetScrollRange SetScrollRange SetScrollPos SetRect InflateRect DestroyIcon OffsetRect IsWindowVisible EnableWindow RedrawWindow GetWindowLongA SetWindowLongA GetSysColor SetActiveWindow SetCursorPos LoadCursorA SetCursor GetDC FillRect IsRectEmpty ReleaseDC IsChild TrackPopupMenu DestroyMenu SetForegroundWindow GetWindowRect EqualRect UpdateWindow ValidateRect InvalidateRect GetClientRect GetFocus GetParent GetTopWindow PostMessageA IsWindow SetParent DestroyCursor SendMessageA SetWindowPos MessageBoxA GetCursorPos GetSystemMetrics EmptyClipboard SetClipboardData OpenClipboard GetClipboardData CloseClipboard wsprintfA WaitForInputIdle GetLastActivePopup RegisterWindowMessageA GetWindowPlacement EndDialog CreateDialogIndirectParamA DestroyWindow EndPaint BeginPaint GetWindowTextLengthA CharUpperA GetForegroundWindow CreateIconIndirect GetIconInfo CopyIcon LoadStringA FindWindowExA SendDlgItemMessageA MapWindowPoints AdjustWindowRectEx GetScrollPos RegisterClassA GetDlgItem mouse_event GetClassNameA GetDesktopWindow GetWindowTextA SetWindowTextA GetMenuItemCount GetMenuItemID GetMenuStringA GetMenuState GetTabbedTextExtentA GrayStringA TabbedTextOutA WindowFromDC CreateWindowExA GetClassLongA IntersectRect RemovePropA EnumChildWindows GetWindowDC UnhookWindowsHookEx CallNextHookEx SetWindowsHookExA IsIconic GetPropA PtInRect UnregisterClassA

gdi32

RoundRect GetCurrentObject DPtoLP LPtoDP StartPage BitBlt GetPixel CreateCompatibleDC GetTextExtentPoint32A SetPixelV Ellipse Rectangle StartDocA DeleteDC GetViewportExtEx ExtSelectClipRgn EndDoc EndPage GetObjectA GetStockObject CreateFontIndirectA CreateSolidBrush FillRgn CreateRectRgn CombineRgn PatBlt CreatePen SelectObject CreatePatternBrush CreateBitmap CreateHatchBrush CreateBrushIndirect CreateDCA CreateCompatibleBitmap GetPolyFillMode GetStretchBltMode GetROP2 GetBkColor GetBkMode GetTextColor CreateRoundRectRgn CreateEllipticRgn PathToRegion EndPath BeginPath GetWindowOrgEx GetViewportOrgEx GetWindowExtEx GetDIBits RealizePalette SelectPalette StretchBlt CreatePalette GetSystemPaletteEntries CreateDIBitmap DeleteObject SelectClipRgn CreatePolygonRgn GetClipRgn SetStretchBltMode SetPixel CreateDIBSection CreateRectRgnIndirect SetBkColor TextOutA SetBkMode SetTextColor StretchDIBits SetDIBitsToDevice SetWindowOrgEx SaveDC RestoreDC CreatePenIndirect PtVisible RectVisible ExtTextOutA Escape FrameRgn OffsetRgn GetTextMetricsA LineTo MoveToEx SetPolyFillMode SetROP2 SetMapMode SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowExtEx ScaleWindowExtEx GetClipBox ExcludeClipRect GetDeviceCaps

msimg32

GradientFill

winspool.drv

DocumentPropertiesA ClosePrinter OpenPrinterA

comdlg32

ChooseColorA ChooseFontA GetOpenFileNameA GetSaveFileNameA GetFileTitleA

advapi32

RegCloseKey RegOpenKeyExA RegSetValueExA RegQueryValueA RegCreateKeyExA

shell32

ShellExecuteA Shell_NotifyIconA SHGetMalloc SHGetPathFromIDListA SHBrowseForFolderA

ole32

CLSIDFromProgID OleInitialize CLSIDFromString CoCreateInstance OleRun OleUninitialize

oleaut32

SafeArrayGetDim SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetElement VariantCopyInd SafeArrayGetLBound VariantCopy VariantClear VariantChangeType SafeArrayGetUBound UnRegisterTypeLi LoadTypeLi LHashValOfNameSys RegisterTypeLi SafeArrayPutElement SafeArrayCreate SafeArrayDestroy SysAllocString VariantInit

comctl32

ImageList_Create ImageList_Destroy ImageList_Read ord17 _TrackMouseEvent ImageList_GetImageInfo ImageList_SetBkColor ImageList_Draw ImageList_GetIcon ImageList_AddMasked ImageList_DrawIndirect ImageList_Duplicate ImageList_GetImageCount

wininet

InternetConnectA InternetSetOptionA InternetCanonicalizeUrlA InternetCrackUrlA HttpOpenRequestA HttpSendRequestA HttpQueryInfoA InternetCloseHandle InternetOpenA InternetReadFile

Çؗ� ^�9)�q)��@ܶ@̈́�>`\2��-~Y4��H��x+��l;�%eƝ��Fپ(en�ZzZvrć��@�J��-�d� q�B�^4�"�O��~q��s_ߵ�o]�d��t:ɭW�?3S�g��԰�w��Tx��y��b��2G5��@�j:��g��x��T��h,$-�m�Ҙ�6�)-x�� |��#�Ō�ϝ�%�_��Ո��Z!��dL��Z{�F6D�{y*�J�Wh{�� W�jӌE��_��A�wձ�(�t��6f��ֱ��8&��/��-�X+Ǒ��d�� y?��:��H��&�Sf}��%��;�94�|Ii̦�T��̶úV0�DRzP��G�jHW��X�~��b(=�H��r�7Aur��󷥓~�ȅԎ�hK��J�W�n��0(�"3t0,��o>Q��_��Ț��4CO~o!u=;��I�<� !HKõt��q�!�1:��i��O�p��B˱5�C5Δ}tq�p�t�]��/��ݻ<��5F��cB�s��L�9T<t#Q��2��O��3�.�|�Xۂ3Z�^�L��G #hp�0��s��aI��G��ǡV��<°y#��i��R�a��f��ѿ�15�h�_-Qu6:W��hZa�L��jcv�;K�nŘ�ꏩ�E)4ms>ƪ�?�u��?U�g+l�vM&mZha��t~��5~%4�=�3ă�<�)��2ɛ�r�r��:��ؘ�z��~sQ=j�e�"pi2�D �6׺SJ��:Z0��C��p!��\M�/(3��v\�W��&E��0��S��#� �~N0;0ԃ�4^��i� �� Hf�a�^m4L��w��@��qD�_5�g��8��,�8�y]g�>��etA�(G��?�䟦�勍��z�46n��s(o��4�#��߉�?cC��}�kƁ/��?��z(&�ݺ'�U�q�bM-4�� }/m�Ƃ�C`�U��tǅ%-��?�/,!�e�]6�"*��{��ϕ�MF�W�!��N�^�[J�n�<^�߰��L�d��K�1�u��@*��ľ�#�lF��S_.��^��-DsEVk�#P�0��T�<��-�&��=�=d^�� 3��k��V�/�׵��3.��G�T �Yy}ع�>P�cs�4��CȻ��f[$�3e�'��Z�O�O ��.�^��G�`��#�cX�� $5�(��#�Ծ��3�|�L�ȅ��pЯ�'1�T}Io�� \��d+��t'�Q?��p��ڔ��'ɒ;8��9��~^*?��5aVP�B�)��k�b�dk��k � "f�5�a��zg"y�e@��x$�A��2�IP��a��Ԉ��R6t�Nc�q(w��,�b��d��VWH��>i�)�`�<�Ut�p��gi!�J�\<b��#f|Eֈ�^�;�H9*�v\A��B��g_1��V $��ᙹ�;I� ��<ym��m��p�޳��#��B�x��_����Pz�Օ�� 7�� :w[7T)��r�QH�d#чR�-n�� W�_?d�>~�jR�'l��3!�jҧ@|{DH��_��!�h��m�0�N�dO�aiD�IvM�c��z��-].Kd��\��G��6�i�w.N��z��_ ��X3��-��6k0>�q��"��s9��n;�W�P�;f?yY*�Þ �=��ˋ��TaD�a�{��[�_"�>��wB�⦗^ a6 67'0iu��i,��iBP�Z#��5�6��s3�$�$y�`{�7IrOȯصwV��蟖5i��IG��05׭2��R�Tp�(Ů��৆�H_��SaV�i'��E��U��lIp��:C��O~*��8X� �&ܺ�E��93��~��:��JC۠ �ٽ/8�9BX1��(��:�U^;�5��T�GR�8�6q�oC�i��ȑZ0�'54��c)��q�4��|~�P�գD�6B?wM��V��A=T��U�A��BT�v��y��2+b�ӷK�*_2�|�V)A�S[j��B)u��閛ȶ��}JM��QK��b�T��:�Hy��R�g�:�d�c�;HK:� ��0�=�f�EA��mb�,��0��#�<��{�훂��8Y�ö��%t5�N�%��ݪ�!��~�V�%Q9�r�}��s�07#��{snM�#{C�50@�%j��5I��SF��p<9�u��3�ҷ2Ҭ��N��9�˽>�M��9�d[%_;��]��-�깷��,��H�rϖ��ޤ�c�Q�w��_�¢��d>��@Q� �D��E��q��_sB��Vܤk1�b3��v�"�M�#�À�I�d��*d0�!z�v�/�*�᩻#�|��a�H#T�G8�mA͠Z��J2Ԥ�SBB��U��7P;� i_��ڧ��˸�F�k!�F!bz'��I��ٗ,�-�DvNs��c�2Q��R�c��!�GHw��6i�{˚Fa��2a8�nN��b�W��N��?��L؄�F��@7�c�Ǜ��4{|bb��1��`�k)1A`�;�E=(�>4�EWق3��:�H_p\��7_�2P��xc�3I�1D]��b-]!��?J��q��~��y$'�YA�E@��bz��x��UiT3>la�|57 �[`�V|�h:�*C�t �u)0��/`�/�Hx��"�N�dݫj�v�eq��7ꨧ'��S4�r�%��G� ��i�D��e��/��B[�]a��Z@�Ā�D=F�p]$�DYaN�p�rrxLk�Y��+��6��)�� ?��z��R��'��*_�e�#ٲUxe�卍Y�z):��״��y��iBS9�~,��

Name

.text

Size

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

766KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

691KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

Virtual Size

292KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.tls

Size

4KB

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp1

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

12KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

7c179f962ec2e24b92f55b37933e8c0d64d13166d5a97353fe095540efb7f6e5

msvfw32

avifil32

rasapi32

iphlpapi

winmm

ws2_32

kernel32

user32

gdi32

msimg32

winspool.drv

comdlg32

advapi32

shell32

ole32

oleaut32

comctl32

wininet

generic