c3fa56199c6df09290e6cf0a7387936e[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

c3fa56199c6df09290e6cf0a7387936e.zip
Size

705KB
MD5

df3173499e5fce8ba5cb72c803b038cc
SHA1

f980d42c8657076b25178c39ebab21a9778eb19a
SHA256

17f6777e48f29c6df4dede11f1c93bbd01b9116d0763d0e46805a55dcee52982
SHA512

68bdca821e4347c156e455360d4b3592807205e71502e80d37cc004a7b601d4e7e9d987895fff9539fb8fc5c9f144ce4210cbd8a365c8cc8dc8a78fb7ea1e528
SSDEEP

12288:oAZnZEkm43BkohddtDCSR3cI9rizLhgpKUjmm/2KX/PHjbzB3VcyxJKyz4hOkzY7:oeaKBBdtDCEVCtrURbzLxjz4DY7

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
static1/unpack001/d533ef455ce7d4761b0c57ef90f6a3052f72e6f5f9180e42d09b1a2430713a00	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/d533ef455ce7d4761b0c57ef90f6a3052f72e6f5f9180e42d09b1a2430713a00

Files

c3fa56199c6df09290e6cf0a7387936e.zip
.zip

Password: infected
d533ef455ce7d4761b0c57ef90f6a3052f72e6f5f9180e42d09b1a2430713a00
.dll windows:4 windows x86 arch:x86

Password: infected

7a5e8741380188e9690ab650f955465a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetVersionExA
GetVersion
GetVersionExA
GetVersion
TerminateProcess
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

DestroyWindow

advapi32

OpenSCManagerA

oleaut32

SysFreeString

version

GetFileVersionInfoA

gdi32

DeleteDC

ole32

ProgIDFromCLSID

comctl32

ImageList_GetDragImage

shell32

ShellExecuteA

urlmon

UrlMkGetSessionOption

wsock32

gethostname

oleacc

ObjectFromLresult

ntdll

NtProtectVirtualMemory

gdiplus

GdiplusStartup

iphlpapi

GetAdaptersInfo

imagehlp

MapFileAndCheckSumA

ws2_32

WSAIoctl

atl

AtlAxGetControl

Sections

CODE
Size: - Virtual size: 768KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 14KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 91KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 732KB - Virtual size: 731KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 196B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

7a5e8741380188e9690ab650f955465a

Headers

File Characteristics

Imports

kernel32

user32

advapi32

oleaut32

version

gdi32

ole32

comctl32

shell32

urlmon

wsock32

oleacc

ntdll

gdiplus

iphlpapi

imagehlp

ws2_32

atl

Sections

CODE Size: - Virtual size: 768KB

DATA Size: - Virtual size: 75KB

BSS Size: - Virtual size: 14KB

.idata Size: - Virtual size: 13KB

.vmp0 Size: - Virtual size: 91KB

.vmp1 Size: 732KB - Virtual size: 731KB

.reloc Size: 512B - Virtual size: 196B

.rsrc Size: 5KB - Virtual size: 30KB

CODE
Size: - Virtual size: 768KB

DATA
Size: - Virtual size: 75KB

BSS
Size: - Virtual size: 14KB

.idata
Size: - Virtual size: 13KB

.vmp0
Size: - Virtual size: 91KB

.vmp1
Size: 732KB - Virtual size: 731KB

.reloc
Size: 512B - Virtual size: 196B

.rsrc
Size: 5KB - Virtual size: 30KB