39b424895b73f142090069c13b1f4b60N[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

39b424895b73f142090069c13b1f4b60N.exe
Size

7.0MB
MD5

39b424895b73f142090069c13b1f4b60
SHA1

acd07dc534899a5acddaf68063ec1c51032b669f
SHA256

b5d603417e8835d3a4c2eaa8b4c62522f4cf7d393bb2507c8bc46f125517cefb
SHA512

3a0e3b0d8a9beb4f80d0160034797ff3d6c08784c3a666bd790a9f0a09c56f01d024ad5c66cad7be31abd50073f1c3282ba0a512727b2d704716955b96fba6c4
SSDEEP

196608:Lg9Gkr9hu/9PgWzku32yrOR/MeCZ6lD8p:L+Fr9ghgz62YI/MefWp

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
39b424895b73f142090069c13b1f4b60N.exe

Files

39b424895b73f142090069c13b1f4b60N.exe
.exe windows:5 windows x86 arch:x86

a6dee43e95ff22531b8b4a949ae46165

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

TranslateMessage
CharUpperBuffW

shlwapi

PathRemoveFileSpecA

rasapi32

RasDialW

wxbase293u_vc_custom

??1wxString@@QAE@XZ

wxmsw293u_adv_vc_custom

?GetEventHashTable@wxGrid@@MBEAAVwxEventHashTable@@XZ

wxmsw293u_core_vc_custom

?MSWCommand@wxWindow@@UAE_NIG@Z

wxmsw293u_richtext_vc_custom

??0wxRichTextAttr@@QAE@XZ

crackcaptchaapi

D2Buf

ws2_32

socket

kernel32

GetVersion
GetVersionExA
LoadLibraryA
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA

ole32

CoUninitialize

oleaut32

LHashValOfNameSys

advapi32

CryptAcquireContextA
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle

wtsapi32

WTSSendMessageW

Sections

.text
Size: - Virtual size: 831KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 220KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 123KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 6.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 6.9MB - Virtual size: 6.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 224B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 101KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a6dee43e95ff22531b8b4a949ae46165

Headers

DLL Characteristics

File Characteristics

Imports

user32

shlwapi

rasapi32

wxbase293u_vc_custom

wxmsw293u_adv_vc_custom

wxmsw293u_core_vc_custom

wxmsw293u_richtext_vc_custom

crackcaptchaapi

ws2_32

kernel32

ole32

oleaut32

advapi32

wtsapi32

Sections

.text Size: - Virtual size: 831KB

.rdata Size: - Virtual size: 220KB

.data Size: - Virtual size: 123KB

.vmp0 Size: - Virtual size: 6.7MB

.vmp1 Size: 6.9MB - Virtual size: 6.9MB

.reloc Size: 512B - Virtual size: 224B

.rsrc Size: 101KB - Virtual size: 101KB

.text
Size: - Virtual size: 831KB

.rdata
Size: - Virtual size: 220KB

.data
Size: - Virtual size: 123KB

.vmp0
Size: - Virtual size: 6.7MB

.vmp1
Size: 6.9MB - Virtual size: 6.9MB

.reloc
Size: 512B - Virtual size: 224B

.rsrc
Size: 101KB - Virtual size: 101KB