lcb[.]vmp[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

lcb.vmp.exe
Size

17.6MB
MD5

1cb693f6928bda0c2ebf52c6e5ffe668
SHA1

f004be3bbc2b101601911eb7885ed5f6a4ea1fff
SHA256

87da7e0260a855fc58b24196cf5a0b17a97afc734717dfef502fe0c68e37f516
SHA512

2bdc104f291aee272ec837bc3dc132e090da8ad100b72c8de53b36461371fc86ebf7205873e3303d89d3de883014b401147d3d3b9562de3d2f8bca3d94c52381
SSDEEP

393216:SD2dycGNHzfCxcUKvHUCxU0dpLQzWWr/XVWaCTRF:1dHGVCxcU+0onc/XVWaS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
lcb.vmp.exe

Files

lcb.vmp.exe
.exe windows:6 windows x64 arch:x64

d60db98016d1cfec5d938f997ac45e97

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

kernel32

LoadLibraryA
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

OpenClipboard

advapi32

CryptEncrypt

shell32

ShellExecuteA

imm32

ImmReleaseContext

ntdll

RtlInitUnicodeString

dwmapi

DwmExtendFrameIntoClientArea

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

rpcrt4

RpcStringFreeA

psapi

GetModuleInformation

userenv

UnloadUserProfile

normaliz

IdnToAscii

wldap32

ord35

crypt32

CertAddCertificateContextToStore

ws2_32

WSAWaitForMultipleEvents

bcrypt

BCryptGenRandom

Sections

.text
Size: - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 476KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 4.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xDIWNES
Size: - Virtual size: 9.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.xDIWNES
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.xDIWNES
Size: 17.6MB - Virtual size: 17.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d60db98016d1cfec5d938f997ac45e97

Headers

DLL Characteristics

File Characteristics

Imports

d3d11

d3dcompiler_43

kernel32

user32

advapi32

shell32

imm32

ntdll

dwmapi

d3dx11_43

rpcrt4

psapi

userenv

normaliz

wldap32

crypt32

ws2_32

bcrypt

Sections

.text Size: - Virtual size: 1.6MB

.rdata Size: - Virtual size: 476KB

.data Size: - Virtual size: 4.9MB

.pdata Size: - Virtual size: 76KB

.xDIWNES Size: - Virtual size: 9.5MB

.xDIWNES Size: 4KB - Virtual size: 4KB

.xDIWNES Size: 17.6MB - Virtual size: 17.6MB

.reloc Size: 512B - Virtual size: 104B

.rsrc Size: 512B - Virtual size: 480B

.text
Size: - Virtual size: 1.6MB

.rdata
Size: - Virtual size: 476KB

.data
Size: - Virtual size: 4.9MB

.pdata
Size: - Virtual size: 76KB

.xDIWNES
Size: - Virtual size: 9.5MB

.xDIWNES
Size: 4KB - Virtual size: 4KB

.xDIWNES
Size: 17.6MB - Virtual size: 17.6MB

.reloc
Size: 512B - Virtual size: 104B

.rsrc
Size: 512B - Virtual size: 480B