Loader[.]vmp[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

Loader.vmp.exe
Size

38.6MB
MD5

075cd225b42fc379b973751235a9baea
SHA1

ab3eb3cac7871f0cc34e0cd738559d4801e57c1d
SHA256

b65ee77897790f3075335db941b7f1d7ba2cbe5e54182f9c623e5dfea31cc2f8
SHA512

54c24e07df0a80d700c570652bbba236979e14f26fb48d5872390d217a6e067c3c8a28a10fa679060a542c73bf216500cff4f4d001e3196b3a5acb93642ef8f8
SSDEEP

786432:xHfYxU8uih4+M+dK+BCdrcwz8a5nThP0JS8GASW:xAxWM4ryKjdrVVTRGGA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Loader.vmp.exe

Files

Loader.vmp.exe
.exe windows:6 windows x64 arch:x64

0477322ed116f99fe1b341b9006e732d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetThreadContext
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress

user32

MessageBoxA

advapi32

RegCloseKey

msvcp140

??1_Lockit@std@@QEAA@XZ

ntdll

RtlVirtualUnwind

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memchr

api-ms-win-crt-runtime-l1-1-0

_exit

api-ms-win-crt-heap-l1-1-0

free

api-ms-win-crt-string-l1-1-0

isalpha

api-ms-win-crt-time-l1-1-0

_mktime64

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf

api-ms-win-crt-utility-l1-1-0

srand

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: - Virtual size: 111KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.TR~
Size: - Virtual size: 23.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.Gdv
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.\LF
Size: 38.6MB - Virtual size: 38.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0477322ed116f99fe1b341b9006e732d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

msvcp140

ntdll

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: - Virtual size: 111KB

.rdata Size: - Virtual size: 20KB

.data Size: - Virtual size: 3KB

.pdata Size: - Virtual size: 7KB

.TR~ Size: - Virtual size: 23.9MB

.Gdv Size: 3KB - Virtual size: 3KB

.\LF Size: 38.6MB - Virtual size: 38.6MB

.rsrc Size: 512B - Virtual size: 480B

.text
Size: - Virtual size: 111KB

.rdata
Size: - Virtual size: 20KB

.data
Size: - Virtual size: 3KB

.pdata
Size: - Virtual size: 7KB

.TR~
Size: - Virtual size: 23.9MB

.Gdv
Size: 3KB - Virtual size: 3KB

.\LF
Size: 38.6MB - Virtual size: 38.6MB

.rsrc
Size: 512B - Virtual size: 480B