f5cb5211d894f2c7bcfe5b58b7e36414ed6385e5d609a710a0d9dc0a7d1f527a

General

Target
f5cb5211d894f2c7bcfe5b58b7e36414ed6385e5d609a710a0d9dc0a7d1f527a
Size 1.2MB
Sample241111-yn8a8syjhp
SHA256 f5cb5211d894f2c7bcfe5b58b7e36414ed6385e5d609a710a0d9dc0a7d1f527a
MD5 bffd91106d532bb39bd3dc0c2248371e
SHA1 94b915ebc7bcab135577dd05fbcadf0a4e7d53dc
SHA512 116ba9d715f5cb14125f0ee8a89aabcd76ca5f582c40bebe04b2d6b51f4bb98ee19e9241c535a32881f4f5ef1a4884a0770b8d601beba1ce1e24ac092adfb1d9
SSDEEP 24576:HovxCwgMBqHO5ZdYXOp0nQrXctTfK+d+MrTXowFlw57XYBwJtih:WIwgMEuy+inDfp3/XoCw57XYBwKh
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

File Explorer

f5cb5211d894f2c7bcfe5b58b7e36414ed6385e5d609a710a0d9dc0a7d1f527a

.exe 1.2MB

f5cb5211d894f2c7bcfe5b58b7e36414ed6385e5d609a710a0d9dc0a7d1f527a

IMPHASH 31f806fb4545c3a3fff561605c32d5c8
SHA256 f5cb5211d894f2c7bcfe5b58b7e36414ed6385e5d609a710a0d9dc0a7d1f527a
MD5 bffd91106d532bb39bd3dc0c2248371e
SHA1 94b915ebc7bcab135577dd05fbcadf0a4e7d53dc
SHA512 116ba9d715f5cb14125f0ee8a89aabcd76ca5f582c40bebe04b2d6b51f4bb98ee19e9241c535a32881f4f5ef1a4884a0770b8d601beba1ce1e24ac092adfb1d9
SSDEEP 24576:HovxCwgMBqHO5ZdYXOp0nQrXctTfK+d+MrTXowFlw57XYBwJtih:WIwgMEuy+inDfp3/XoCw57XYBwKh
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect

PE Signature issue

Digest

2b:ce:90:40:d0:f6:b9:d1:4c:69:c1:54:a3:94:ab:75:5a:08:3a:fb

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=xiao xuan,ST=山东菏泽,C=China,1.2.840.113549.1.9.1=#0c11323238353138313339374071712e636f6d

Chains

Nov 11, 2024

Minor OS version

0

Major OS version

4

Entry point

3013386

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

Virtual Size

960KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

623KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

395KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

68KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vmp0

Size

Virtual Size

192KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_WRITE

Name

.vmp1

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

f5cb5211d894f2c7bcfe5b58b7e36414ed6385e5d609a710a0d9dc0a7d1f527a

PE Signature issue

winmm

ws2_32

rasapi32

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

wininet

comdlg32

generic

Sharing

General

Malware Config

Signatures

File Explorer

f5cb5211d894f2c7bcfe5b58b7e36414ed6385e5d609a710a0d9dc0a7d1f527a

PE Signature issue

winmm

ws2_32

rasapi32

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

wininet

comdlg32

generic