vmp[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

vmp.exe
Size

74.6MB
MD5

d8dabd8bbfbfbc4adf83dd36840124b2
SHA1

c8d9bc0a0ac6b7ed7fb162420dbc6e90e0bb1fdb
SHA256

5d86b5f82644f011080cc1bea9a5f133899443b7b614a142729c42fdb550282b
SHA512

6ee64d02501802c5b1779c12b499b56d7da93770f46214f21d7c5e791f6ea81934424374831f365d42628ded70073cd3ed2330c34cfd86abc7e6ee0909b01516
SSDEEP

1572864:wZTQz1c+6gi1m6uxD/lZWaTIrr9MXtXVg:wZcJc+Pi18/lZWX7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
vmp.exe

Files

vmp.exe
.exe windows:6 windows x64 arch:x64

ebed933ad85e8a528f6e0f325f3242e9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

kernel32

CheckRemoteDebuggerPresent
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

GetKeyState

gdi32

GetStockObject

advapi32

AddAccessAllowedAce

msvcp140

??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z

imm32

ImmReleaseContext

ntdll

RtlVirtualUnwind

dwmapi

DwmExtendFrameIntoClientArea

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

urlmon

URLDownloadToFileA

rpcrt4

UuidToStringA

psapi

GetModuleInformation

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

strchr

api-ms-win-crt-stdio-l1-1-0

fread

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

strncmp

api-ms-win-crt-heap-l1-1-0

realloc

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv

api-ms-win-crt-filesystem-l1-1-0

_wremove

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-math-l1-1-0

cosf

api-ms-win-crt-locale-l1-1-0

localeconv

api-ms-win-crt-environment-l1-1-0

getenv

shell32

ShellExecuteA

normaliz

IdnToAscii

wldap32

ord26

crypt32

CertFindCertificateInStore

ws2_32

sendto

bcrypt

BCryptGenRandom

Sections

.text
Size: - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 404KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 5.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.\9-
Size: - Virtual size: 24.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.4l7
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.9w5
Size: 42.7MB - Virtual size: 42.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 296B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rbdata
Size: 116KB - Virtual size: 116KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ebed933ad85e8a528f6e0f325f3242e9

Headers

DLL Characteristics

File Characteristics

Imports

d3d11

d3dcompiler_43

kernel32

user32

gdi32

advapi32

msvcp140

imm32

ntdll

dwmapi

d3dx11_43

urlmon

rpcrt4

psapi

userenv

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-environment-l1-1-0

shell32

normaliz

wldap32

crypt32

ws2_32

bcrypt

Sections

.text Size: - Virtual size: 1.3MB

.rdata Size: - Virtual size: 404KB

.data Size: - Virtual size: 5.5MB

.pdata Size: - Virtual size: 61KB

.\9- Size: - Virtual size: 24.6MB

.4l7 Size: 6KB - Virtual size: 5KB

.9w5 Size: 42.7MB - Virtual size: 42.7MB

.reloc Size: 512B - Virtual size: 296B

.rsrc Size: 512B - Virtual size: 480B

.rbdata Size: 116KB - Virtual size: 116KB

.text
Size: - Virtual size: 1.3MB

.rdata
Size: - Virtual size: 404KB

.data
Size: - Virtual size: 5.5MB

.pdata
Size: - Virtual size: 61KB

.\9-
Size: - Virtual size: 24.6MB

.4l7
Size: 6KB - Virtual size: 5KB

.9w5
Size: 42.7MB - Virtual size: 42.7MB

.reloc
Size: 512B - Virtual size: 296B

.rsrc
Size: 512B - Virtual size: 480B

.rbdata
Size: 116KB - Virtual size: 116KB