4aff856617d70e84c872255446d90bcf[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

4aff856617d70e84c872255446d90bcf.zip
Size

705KB
MD5

292e401de9aa08c6b9d6920d26e75e93
SHA1

37f7ba3926b516ade068872738ad7b65dfbf7ef8
SHA256

96f7c8bfa2c008e633f97287d032281aa66c94db48c8d9788e582fc6bbd85008
SHA512

4bdbfaa55b0c1d15e85a0671f58207910484a503527db7ef95b1d2b87a22a581e1cbd2eeff708c2e4c68b53f472dcdcd124a19906f0774213a56eec611a312bf
SSDEEP

12288:melsrUxbClxMnWKhC1kboUFNrHKgymjjsO0EiUKR1yOQZYYZ9cvO4NRNcAFYorX:meSrU9drE1qoUFNrHKoD0EilR1NQ9eRB

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
static1/unpack001/9b073d9732865a185b43c4dfaa2bbd109bb96645fc30df87d92b77b599340fc9	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/9b073d9732865a185b43c4dfaa2bbd109bb96645fc30df87d92b77b599340fc9

Files

4aff856617d70e84c872255446d90bcf.zip
.zip

Password: infected
9b073d9732865a185b43c4dfaa2bbd109bb96645fc30df87d92b77b599340fc9
.dll windows:4 windows x86 arch:x86

Password: infected

7a5e8741380188e9690ab650f955465a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetVersionExA
GetVersion
GetVersionExA
GetVersion
TerminateProcess
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

DestroyWindow

advapi32

OpenSCManagerA

oleaut32

SysFreeString

version

GetFileVersionInfoA

gdi32

DeleteDC

ole32

ProgIDFromCLSID

comctl32

ImageList_GetDragImage

shell32

ShellExecuteA

urlmon

UrlMkGetSessionOption

wsock32

gethostname

oleacc

ObjectFromLresult

ntdll

NtProtectVirtualMemory

gdiplus

GdiplusStartup

iphlpapi

GetAdaptersInfo

imagehlp

MapFileAndCheckSumA

ws2_32

WSAIoctl

atl

AtlAxGetControl

Sections

CODE
Size: - Virtual size: 768KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 14KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 91KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 732KB - Virtual size: 731KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 196B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

7a5e8741380188e9690ab650f955465a

Headers

File Characteristics

Imports

kernel32

user32

advapi32

oleaut32

version

gdi32

ole32

comctl32

shell32

urlmon

wsock32

oleacc

ntdll

gdiplus

iphlpapi

imagehlp

ws2_32

atl

Sections

CODE Size: - Virtual size: 768KB

DATA Size: - Virtual size: 75KB

BSS Size: - Virtual size: 14KB

.idata Size: - Virtual size: 13KB

.vmp0 Size: - Virtual size: 91KB

.vmp1 Size: 732KB - Virtual size: 731KB

.reloc Size: 512B - Virtual size: 196B

.rsrc Size: 5KB - Virtual size: 30KB

CODE
Size: - Virtual size: 768KB

DATA
Size: - Virtual size: 75KB

BSS
Size: - Virtual size: 14KB

.idata
Size: - Virtual size: 13KB

.vmp0
Size: - Virtual size: 91KB

.vmp1
Size: 732KB - Virtual size: 731KB

.reloc
Size: 512B - Virtual size: 196B

.rsrc
Size: 5KB - Virtual size: 30KB