cyber[.]exe | Triage™

Resubmissions

03/07/2026, 10:18

260703-mcb8waft2y

03/07/2026, 10:17

260703-mbrxyaft2v7

Sharing

Copy URL Twitter E-mail

General

Target
cyber.exe
Size 10.7MB
Sample260703-mcb8waft2y
SHA256 42205c2bcf1defde4ded3a6869435a5235eb103a941f5b33443870d559251f29
MD5 02212fdd7a3f22b5677dc051e04090bc
SHA1 77daabd6c5fa8d64ec92b1d662bc971a2379517d
SHA512 7156d39472727a2cd4decd42608991420a67f6d57d5fafac2bb99cb51a8635b9aefc7057c05a8b31fd7237528e0dee50db0c5accca089bd2497c4a41220aa18f
SSDEEP 49152:bSxa/tYVXYT/4RUXc0X1KeNoyZZQtcvbIwYTbTMsBzSayk+tmeGfanoSB0TkzOva:bSesA/4RU71vNfkU7CPMufL
TLSH
T14DB6134752AD81E8F166E434195E6613E3B5BC848738DEDB07D04C372FA76E20BBEA11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

vmprotect themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cyber.exe

File Explorer

cyber.exe

.exe 10.7MB

cyber.exe

IMPHASH 2b1150e6b85333687d67bb0bcaf73368
SHA256 42205c2bcf1defde4ded3a6869435a5235eb103a941f5b33443870d559251f29
MD5 02212fdd7a3f22b5677dc051e04090bc
SHA1 77daabd6c5fa8d64ec92b1d662bc971a2379517d
SHA512 7156d39472727a2cd4decd42608991420a67f6d57d5fafac2bb99cb51a8635b9aefc7057c05a8b31fd7237528e0dee50db0c5accca089bd2497c4a41220aa18f
SSDEEP 49152:bSxa/tYVXYT/4RUXc0X1KeNoyZZQtcvbIwYTbTMsBzSayk+tmeGfanoSB0TkzOva:bSesA/4RU71vNfkU7CPMufL
TLSH
T14DB6134752AD81E8F166E434195E6613E3B5BC848738DEDB07D04C372FA76E20BBEA11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9720692

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegOpenKeyExA RegCloseKey

d3d9

Direct3DCreate9

kernel32

GlobalAlloc GlobalUnlock GlobalLock GlobalFree GetStdHandle Sleep GetCurrentThread GetModuleHandleA GetProcAddress SetConsoleCursorInfo GetConsoleScreenBufferInfoEx SetConsoleScreenBufferInfoEx SetConsoleTitleA GetCurrentConsoleFontEx SetCurrentConsoleFontEx GetConsoleWindow GetTempPathA CloseHandle OpenProcess ReadProcessMemory WriteProcessMemory lstrcmpiA CreateToolhelp32Snapshot Process32First Process32Next Module32FirstW Module32NextW Module32First QueryPerformanceCounter QueryPerformanceFrequency MultiByteToWideChar GetConsoleMode SetConsoleMode IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter CreateProcessA RtlLookupFunctionEntry RtlCaptureContext WakeAllConditionVariable GetCurrentThreadId SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive WideCharToMultiByte GetFileInformationByHandleEx GetModuleHandleW GetLastError AreFileApisANSI SetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateFileW CreateDirectoryW GetLocaleInfoEx FormatMessageA LocalFree GetModuleFileNameA GetCurrentProcessId GetSystemTimeAsFileTime RtlVirtualUnwind InitializeSListHead

user32

GetWindowThreadProcessId GetClassNameA EnumWindows SetWindowLongA GetWindowLongA OpenClipboard SetProcessDPIAware SetClipboardData EmptyClipboard SetLayeredWindowAttributes GetWindowLongW SetWindowLongW GetAsyncKeyState mouse_event CloseClipboard GetSystemMetrics GetWindowTextA GetForegroundWindow UpdateWindow IsWindowVisible SetWindowDisplayAffinity SetWindowPos ShowWindow DestroyWindow CreateWindowExW RegisterClassExW UnregisterClassW PostQuitMessage DefWindowProcW PeekMessageA DispatchMessageA TranslateMessage LoadCursorA ScreenToClient SetCursor SetCursorPos SendInput GetWindowRect GetCursorPos ClientToScreen ClipCursor FindWindowA GetClipboardData GetActiveWindow GetKeyState GetCapture SetCapture ReleaseCapture GetClientRect

shell32

ShellExecuteA

msvcp140

?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z _Query_perf_counter _Query_perf_frequency ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ??Bid@locale@std@@QEAA_KXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Random_device@std@@YAIXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Xbad_function_call@std@@YAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A _Thrd_detach ?_Throw_Cpp_error@std@@YAXH@Z _Cnd_do_broadcast_at_thread_exit _Mtx_lock _Mtx_unlock ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Locinfo@std@@QEAA@XZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ?c_str@?$_Yarn@D@std@@QEBAPEBDXZ ??0facet@locale@std@@IEAA@_K@Z ??1facet@locale@std@@MEAA@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Incref@facet@locale@std@@UEAAXXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?id@?$numpunct@D@std@@2V0locale@2@A ??0_Lockit@std@@QEAA@H@Z ?_Xbad_alloc@std@@YAXXZ ??1_Lockit@std@@QEAA@XZ

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpSendRequest WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect

dwmapi

DwmExtendFrameIntoClientArea

winmm

mciSendStringA

imm32

ImmReleaseContext ImmSetCompositionWindow ImmGetContext

vcruntime140

__std_terminate __C_specific_handler __current_exception_context __current_exception strstr memset memmove memcpy memcmp memchr __std_exception_copy _CxxThrowException __std_exception_destroy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _initterm_e _initterm _set_app_type _seh_filter_exe _exit _cexit _crt_atexit _register_onexit_function exit _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv abort _invalid_parameter_noinfo_noreturn _errno _get_initial_narrow_environment _beginthreadex terminate

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf __acrt_iob_func fgetc fflush fputc fgetpos __p__commode _set_fmode ftell fseek ferror _wfopen _get_stream_buffer_pointers __stdio_common_vsprintf_s fread __stdio_common_vsscanf fsetpos __stdio_common_vsprintf feof ungetc setvbuf fclose fwrite _fseeki64

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file remove

api-ms-win-crt-string-l1-1-0

wcscpy_s strncmp strcmp _wcsicmp strncpy_s isprint strncpy _stricmp

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc realloc _callnewh free calloc

api-ms-win-crt-convert-l1-1-0

atof strtoull strtoll strtod strtol

api-ms-win-crt-environment-l1-1-0

_dupenv_s

api-ms-win-crt-math-l1-1-0

_ldsign cosf sqrtf atan2f powf sinf ceilf _fdsign pow ldexp tanf fmodf _dsign __setusermatherr lroundf floorf

api-ms-win-crt-locale-l1-1-0

localeconv ___lc_codepage_func _configthreadlocale

api-ms-win-crt-utility-l1-1-0

qsort rand

Name

.text

Size

9.3MB

Virtual Size

9.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

471KB

Virtual Size

471KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

908KB

Virtual Size

940KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

29KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vmp0

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp1

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp2

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.themida

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.enigma1

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.enigma2

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

804B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

cyber.exe

advapi32

d3d9

kernel32

user32

shell32

msvcp140

winhttp

dwmapi

winmm

imm32

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-utility-l1-1-0

generic