Gh0zt[.]vmp[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

Gh0zt.vmp.exe
Size

17.8MB
MD5

e772f4fce400f229c418350840994c7c
SHA1

e5e455ec447c2d4c10bdb8191d93b1b04e98a756
SHA256

2cda0106eb29dde686dc2ee24289f7432afe33d8f8690565bf65ac71afb8b9cf
SHA512

da526275b576d51dad41324c9194da80e9285a72a3fa966f2f599dfbb0d35dadde8431c990bd6421f2b80ff9b589c110b15ad67309d2d63c6cea87682e9ba28f
SSDEEP

393216:062NCBF6/Dame/xE1hFKjhWMCLuihcYy:MCBFSaZE1khBCy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Gh0zt.vmp.exe

Files

Gh0zt.vmp.exe
.exe windows:6 windows x64 arch:x64

14ceb042fec31507e785bc12f20f97da

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ole32

CoTaskMemFree

shell32

SHGetKnownFolderPath

d3d9

Direct3DCreate9

kernel32

QueryFullProcessImageNameW

user32

RegisterClassExA

advapi32

OpenProcessToken

msvcp140

??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ

msvcp140_atomic_wait

__std_free_crt

imm32

ImmGetContext

normaliz

IdnToAscii

wldap32

ord32

crypt32

CertFreeCertificateChain

ws2_32

socket

shlwapi

PathFindFileNameW

rpcrt4

RpcStringFreeA

psapi

GetModuleInformation

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

strrchr

api-ms-win-crt-stdio-l1-1-0

_lseeki64

api-ms-win-crt-heap-l1-1-0

malloc

api-ms-win-crt-filesystem-l1-1-0

_access

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table

api-ms-win-crt-math-l1-1-0

sinf

api-ms-win-crt-convert-l1-1-0

strtod

api-ms-win-crt-locale-l1-1-0

localeconv

api-ms-win-crt-utility-l1-1-0

srand

api-ms-win-crt-time-l1-1-0

_gmtime64

api-ms-win-crt-string-l1-1-0

strncpy

api-ms-win-crt-environment-l1-1-0

getenv

Sections

47A6760E
Size: - Virtual size: 992KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

C053D072
Size: - Virtual size: 581KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

D0908E11
Size: - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

F8519D75
Size: - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

AC87FC00
Size: - Virtual size: 11.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

4AE008E0
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

FAE72D47
Size: 17.6MB - Virtual size: 17.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

F7C59C9C
Size: 113KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

14ceb042fec31507e785bc12f20f97da

Headers

DLL Characteristics

File Characteristics

Imports

ole32

shell32

d3d9

kernel32

user32

advapi32

msvcp140

msvcp140_atomic_wait

imm32

normaliz

wldap32

crypt32

ws2_32

shlwapi

rpcrt4

psapi

userenv

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-environment-l1-1-0

Sections

47A6760E Size: - Virtual size: 992KB

C053D072 Size: - Virtual size: 581KB

D0908E11 Size: - Virtual size: 15KB

F8519D75 Size: - Virtual size: 40KB

AC87FC00 Size: - Virtual size: 11.4MB

4AE008E0 Size: 5KB - Virtual size: 5KB

FAE72D47 Size: 17.6MB - Virtual size: 17.6MB

F7C59C9C Size: 113KB - Virtual size: 113KB

47A6760E
Size: - Virtual size: 992KB

C053D072
Size: - Virtual size: 581KB

D0908E11
Size: - Virtual size: 15KB

F8519D75
Size: - Virtual size: 40KB

AC87FC00
Size: - Virtual size: 11.4MB

4AE008E0
Size: 5KB - Virtual size: 5KB

FAE72D47
Size: 17.6MB - Virtual size: 17.6MB

F7C59C9C
Size: 113KB - Virtual size: 113KB