VMX-Spoofer[.]rar | Triage™

General

Target
VMX-Spoofer.rar
Size 3.4MB
Sample240803-a3k79axbpl
SHA256 a8273705002785a0db17525650ef59ad3ddf6b475ac9475a7a8d00f3893e9adf
MD5 a559dc48f81d4f3b3c20419c602931de
SHA1 52dfbc1d111d5b4d72d2b71fcbed6e6dbe19e68c
SHA512 ef95d73fdd84d2d9c9a416c9272a221f271d094674a86e35a124b7caa92ccd442bab7385faa10bd81487714013c69bbd22aec61e0f1393121deeb3585308bdf4
SSDEEP 98304:Qu3Z9Y8Fugxop2a7GL94r/SWBl2w4abllQwqva:QuIjF7g94rxSw4ab1qva
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
static1/unpack001/VMXSPF/VMXSPF.exe	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/VMXSPF/VMXSPF.exe

File Explorer

VMX-Spoofer.rar

.rar 3.4MB
VMXSPF/VMXSPF.exe

.exe 3.5MB

VMX-Spoofer.rar

SHA256 a8273705002785a0db17525650ef59ad3ddf6b475ac9475a7a8d00f3893e9adf
MD5 a559dc48f81d4f3b3c20419c602931de
SHA1 52dfbc1d111d5b4d72d2b71fcbed6e6dbe19e68c
SHA512 ef95d73fdd84d2d9c9a416c9272a221f271d094674a86e35a124b7caa92ccd442bab7385faa10bd81487714013c69bbd22aec61e0f1393121deeb3585308bdf4
SSDEEP 98304:Qu3Z9Y8Fugxop2a7GL94r/SWBl2w4abllQwqva:QuIjF7g94rxSw4ab1qva
MD5 SHA1 SHA512 SSDEEP

Password

1234

VMXSPF/VMXSPF.exe

SHA256 e1a7972f5375eeb34a3f3a4d1177704ed211044c9e24e4ac601f582ce47f10a1
MD5 39bf6ccd737cc9c0c3801fc3b3455441
SHA1 7a51f28bbb4da653119fb0fa1679ef67b906e5f1
SHA512 98b5b88440e8acfcf57d2cdba686ad4848a0a6140dbfed6d1ba69a4ef0fbe9b8e6e96fd767fa3b3997ebbef00df68c7c26ec40d45ab23c185c51f06926c62aec
SSDEEP 98304:9JyDACLJdRIAGM9wqp4cOPs3fH0MtZ/1X:raACLJdvGMGcgUfUyZ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Password

1234

Minor OS version

0

Major OS version

4

Entry point

6078552

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

Size

42KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

1024B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.idata

Size

512B

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

5.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

3.4MB

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

VMX-Spoofer.rar

VMXSPF/VMXSPF.exe

generic