Verse serial checker[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Verse serial checker.exe
Size 1.8MB
Sample260604-vh38jsbs3s
SHA256 0978fa3f543139a0df186b07e1a16ef2e2e025f49afb7672e95f76bd60f8a7eb
MD5 2f87869a2f7dccf2eea28dfac1ff7de8
SHA1 464fdf77fac4b6f90d9037fdde0006c596358e5d
SHA512 448632fae9ac5c52e94a9b75ab2e658591dc36ec9b261985c2ff001a66d434a120d260fe6bc012536800be5b0f2544f92ead07694a81e60acf15bfdf5e5e88cc
SSDEEP 49152:jMoW0xIKGL48vMdX6qADsxISnByTqKq9DMbJcioxcKK2SewFiYCJc7vfmIpW:bxIKG46qN9DMbJcioxcKK2SewFiYCJcw
TLSH
T16595AE37E39100E8D0679238C46B9B73ED75B84B172066DB37D49A627F936D09E3A390
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Verse serial checker.exe

File Explorer

Verse serial checker.exe

.exe 1.8MB

Verse serial checker.exe

IMPHASH f0d47b70da977baee80aa13222eb1e08
SHA256 0978fa3f543139a0df186b07e1a16ef2e2e025f49afb7672e95f76bd60f8a7eb
MD5 2f87869a2f7dccf2eea28dfac1ff7de8
SHA1 464fdf77fac4b6f90d9037fdde0006c596358e5d
SHA512 448632fae9ac5c52e94a9b75ab2e658591dc36ec9b261985c2ff001a66d434a120d260fe6bc012536800be5b0f2544f92ead07694a81e60acf15bfdf5e5e88cc
SSDEEP 49152:jMoW0xIKGL48vMdX6qADsxISnByTqKq9DMbJcioxcKK2SewFiYCJc7vfmIpW:bxIKG46qN9DMbJcioxcKK2SewFiYCJcw
TLSH
T16595AE37E39100E8D0679238C46B9B73ED75B84B172066DB37D49A627F936D09E3A390
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

951472

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

kernel32

GetFileSizeEx CreateProcessW GetFileType GetStdHandle WaitForMultipleObjects PeekNamedPipe GlobalMemoryStatusEx GetEnvironmentVariableA InitOnceComplete InitOnceBeginInitialize ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext WaitForSingleObjectEx MoveFileExA RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter FormatMessageA GetStartupInfoW GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead LocalFree SetLastError VerifyVersionInfoA GetSystemDirectoryA SleepEx DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection QueryPerformanceCounter VerSetConditionMask QueryPerformanceFrequency LoadLibraryA GlobalUnlock GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar CreateFileW GetCurrentProcessId ExitProcess GetProcAddress GetLocalTime SetFileAttributesA LoadLibraryW WaitForSingleObject TerminateProcess WideCharToMultiByte GetSystemFirmwareTable IsProcessorFeaturePresent GetModuleHandleA GetFirmwareEnvironmentVariableA GetCurrentProcess GetTickCount CloseHandle DeleteFileW CreateFileA GetLastError Sleep GetFileAttributesW FindClose GetTempPathW CreatePipe FindNextFileA DeviceIoControl FindFirstFileA SetHandleInformation CompareFileTime ReadFile CreateProcessA CopyFileW FreeLibrary IsDebuggerPresent GetModuleHandleW

user32

DestroyWindow GetWindowRect CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow GetCursorPos DispatchMessageW SetWindowLongA PeekMessageW MessageBoxA UpdateWindow PostQuitMessage wsprintfW GetKeyState ClientToScreen GetCapture ScreenToClient TrackMouseEvent SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData EnumDisplayDevicesW EnumDisplaySettingsW GetWindowLongW GetWindowThreadProcessId DefWindowProcW GetForegroundWindow MoveWindow GetDialogBaseUnits SetLayeredWindowAttributes TranslateMessage LoadCursorW LoadIconW

advapi32

CryptHashData CryptDestroyHash CryptGetHashParam CryptReleaseContext RegEnumKeyExW RegOpenKeyExW RegQueryValueExW AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegCloseKey QueryServiceStatus CloseServiceHandle RegQueryValueExA OpenSCManagerW QueryServiceConfigA RegCreateKeyExA GetUserNameA ChangeServiceConfigA RegSetValueExA StartServiceW RegOpenKeyExA OpenServiceA CryptCreateHash CryptAcquireContextW CryptAcquireContextA CryptGenRandom CryptDestroyKey CryptImportKey CryptEncrypt

shell32

ShellExecuteA SHGetFolderPathW ShellExecuteW SHGetFolderPathA

ole32

CoCreateInstance CoUninitialize CoSetProxyBlanket CoInitializeSecurity CoInitializeEx

oleaut32

SafeArrayGetLBound SysFreeString SysAllocString SafeArrayGetElement SafeArrayGetUBound VariantInit VariantClear

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z _Mtx_lock _Mtx_unlock ?_Xinvalid_argument@std@@YAXPEBD@Z ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Locinfo@std@@QEAA@XZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ??0facet@locale@std@@IEAA@_K@Z ??1facet@locale@std@@MEAA@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?tolower@?$ctype@D@std@@QEBADD@Z ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??Bios_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ _Strxfrm _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?uncaught_exception@std@@YA_NXZ ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Random_device@std@@YAIXZ ?_Xlength_error@std@@YAXPEBD@Z ?id@?$collate@D@std@@2V0locale@2@A _Strcoll _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ

normaliz

IdnToAscii

wldap32

ord217 ord46 ord211 ord60 ord45 ord50 ord41 ord22 ord26 ord27 ord32 ord33 ord35 ord79 ord30 ord200 ord301 ord143

crypt32

CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringA CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryA CertFreeCertificateContext CertEnumCertificatesInStore CryptEncodeObjectEx CertOpenStore CertCloseStore CertFindCertificateInStore

ws2_32

getpeername connect bind closesocket WSAGetLastError send recv gethostname htons ntohs setsockopt socket WSASetLastError WSAIoctl WSAStartup WSACleanup __WSAFDIsSet select accept htonl listen ioctlsocket getaddrinfo freeaddrinfo recvfrom sendto getsockname ntohl getsockopt

wininet

InternetReadFile HttpQueryInfoA InternetOpenUrlW InternetOpenW InternetCloseHandle

comctl32

ord345

wlanapi

WlanCloseHandle WlanFreeMemory WlanEnumInterfaces WlanOpenHandle

tbs

Tbsi_Context_Create Tbsip_Context_Close Tbsi_GetDeviceInfo Tbsip_Submit_Command

setupapi

SetupDiGetDeviceInstanceIdW SetupDiGetDeviceRegistryPropertyW SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiOpenDevRegKey SetupDiGetClassDevsW

iphlpapi

GetIpNetTable GetAdaptersInfo

ncrypt

NCryptOpenStorageProvider NCryptGetProperty NCryptFreeObject

imm32

ImmSetCandidateWindow ImmGetContext ImmSetCompositionWindow ImmReleaseContext

dwmapi

DwmExtendFrameIntoClientArea

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context __current_exception memchr __std_exception_destroy memcmp memset memmove memcpy strrchr strstr strchr __std_terminate __std_exception_copy _CxxThrowException __C_specific_handler

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _initialize_onexit_table _register_onexit_function _crt_atexit terminate _getpid _cexit _beginthreadex __sys_nerr _seh_filter_exe abort strerror _register_thread_local_exe_atexit_callback _set_app_type _get_narrow_winmain_command_line _initterm _initterm_e _c_exit _invoke_watson _errno _exit exit _initialize_narrow_environment

api-ms-win-crt-stdio-l1-1-0

fread fsetpos _set_fmode ungetc __stdio_common_vswprintf ftell __acrt_iob_func fseek __stdio_common_vfprintf fflush _wfopen _get_stream_buffer_pointers fclose _read feof fopen fputc fputs setvbuf fgetpos __stdio_common_vsprintf fwrite _open _close _lseeki64 __stdio_common_vsscanf fgets fgetc __stdio_common_vsprintf_s __p__commode _write _fseeki64

api-ms-win-crt-heap-l1-1-0

calloc _callnewh _set_new_mode free malloc realloc

api-ms-win-crt-string-l1-1-0

_strdup strcspn strcmp strspn wcslen strpbrk strncmp strlen strncpy tolower towupper isupper isdigit ispunct isspace toupper

api-ms-win-crt-math-l1-1-0

_dclass acosf __setusermatherr ceilf pow _dsign sinf cosf sqrtf

api-ms-win-crt-time-l1-1-0

_gmtime64 _mktime64 strftime _localtime64_s _time64

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _access _unlink _fstat64 _stat64 _lock_file

api-ms-win-crt-locale-l1-1-0

localeconv _configthreadlocale

api-ms-win-crt-convert-l1-1-0

strtoul atoi strtol strtoll

Name

.text

Size

957KB

Virtual Size

956KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

414KB

Virtual Size

413KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

324KB

Virtual Size

328KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vmp0

Size

512B

Virtual Size

13B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

512B

Virtual Size

13B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

140KB

Virtual Size

140KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Verse serial checker.exe

d3dx11_43

d3d11

d3dcompiler_47

kernel32

user32

advapi32

shell32

ole32

oleaut32

msvcp140

normaliz

wldap32

crypt32

ws2_32

wininet

comctl32

wlanapi

tbs

setupapi

iphlpapi

ncrypt

imm32

dwmapi

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-convert-l1-1-0

generic