averis 1.2.rar
- SHA256 22a5927a742fcc73456aab591e716e8e5f661b2a626a5d7e15b0813188686775
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
averis 1.2.rar
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
averis 1.2.rar
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target averis 1.2.rar
- Size 14.4MB
- Sample260705-v232wsas8q
- SHA256 22a5927a742fcc73456aab591e716e8e5f661b2a626a5d7e15b0813188686775
- MD5 ff14fe0422f2a0374239211f035502c7
- SHA1 1f6d16a08bd68663c0910eae4a262e80cb6077f1
- SHA512 d01fbc9ea634732b8cf16b029138ee34af14d447a3218823e353aba13380493590f14760bf29fca71f8d17cb6baab0affdcfb502fceebb29cb2da7dc2d09112d
- SSDEEP 393216:w9RwsemsLmuWe3gHm/05thXcP+C6h14Yz2ceytvD/S+q5A6LmK:ywsemsSuLF/0TdcPuSULxW5A6KK
- TLSH T13CE6333A7203F419E97E019D22D81B5F1B6B2A6C2EFCAC82D17859F98547F0237D498D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/VMProtectSDK64.dll unpack001/priv.exe
File Explorer
-
averis 1.2.rar.rar 14.4MB
-
VMProtectSDK64.dll.dll 116KB
-
priv.exe.exe 64.4MB
VMProtectSDK64.dll
- IMPHASH 1851ff453adce0cef5274e320d5bed3c
- SHA256 af82c309ace1ce81c23aa190c65f4eaa4e2e668e227175e66b0637b56f546796
- MD5 724d8234d574846b6ee2262a2977650d
- SHA1 b3fb659ddb3306e23342a0232b9b85e924ae36d5
- SHA512 3ea5ed4fb38986098d19221e5dbf4f48a0ccf5c912235bfdc160bb949721c298e904bbaa1070beb67cb9cfdabb0163a7a51e593f37e2bc03c69b7200c3967e83
- SSDEEP 3072:xmcqYHq7Aiytzg2ScpvgJcG5sqYX6UmHRlBS:80Hq7AiyegZgJZSX+xH
- TLSH T1F6C36C57B3E540BBE1B6C679C8634A55D3B678150B24DBAF07A402162F233D18E3AF72
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
8864
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
IsDebuggerPresent
GetLocalTime
GetTickCount
GetModuleFileNameW
GetPrivateProfileStringW
MultiByteToWideChar
WideCharToMultiByte
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
InterlockedFlushSList
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
HeapFree
HeapAlloc
GetStringTypeW
GetACP
GetStdHandle
GetFileType
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetStdHandle
HeapSize
HeapReAlloc
GetConsoleMode
FlushFileBuffers
WriteFile
GetConsoleCP
SetFilePointerEx
CloseHandle
WriteConsoleW
CreateFileW
RaiseException
VMProtectActivateLicense
VMProtectBegin
VMProtectBeginMutation
VMProtectBeginUltra
VMProtectBeginUltraLockByKey
VMProtectBeginVirtualization
VMProtectBeginVirtualizationLockByKey
VMProtectDeactivateLicense
VMProtectDecryptStringA
VMProtectDecryptStringW
VMProtectEnd
VMProtectFreeString
VMProtectGetCurrentHWID
VMProtectGetOfflineActivationString
VMProtectGetOfflineDeactivationString
VMProtectGetSerialNumberData
VMProtectGetSerialNumberState
VMProtectIsDebuggerPresent
VMProtectIsProtected
VMProtectIsValidImageCRC
VMProtectIsVirtualMachinePresent
VMProtectSetSerialNumber
Name
.text
Size
67KB
Virtual Size
66KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
39KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
512B
Virtual Size
148B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=241, version=40116,
count=124, id=243, version=40116,
count=14, id=242, version=40116,
count=7, id=259, version=24123,
count=20, id=261, version=24123,
count=17, id=260, version=24123,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=90, id=1, productName=Unmarked objects,
count=2, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
priv.exe
- IMPHASH 5a94f410e1f7b619028a7999fddf5b48
- SHA256 340be94e8e78ecb71a8ed58df3aad4e4cbb2eea8a58a837387b5a0fcfb1262e9
- MD5 e560b9454682d2e0f9743fae814c3140
- SHA1 be155ba3517d1eeedf267d0a2ca7a13195c25308
- SHA512 823d83b2fec299d4217753d272c39ca1745913091dabf917059726d086ed3ba696d25706035d88b5d211956412834ac7c4a738eb40dcb67cf79916238f8d8ab5
- SSDEEP 393216:TJN1XwW50X0sIMD0Do3mA8fnN/wg/9D0RvwktigYVPhB06LNd6oXC7z:NNp2XdIMD0Do3m7fN/Lslt4zpn9XC7z
- TLSH T11BE7514C24110EE891ABE815AA67CF1B5FE9D6EB4BE8254DBCA58E340CD3CF7191074B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
56292672
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetWindowsDirectoryA
GetModuleHandleW
OutputDebugStringA
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
GetLocaleInfoA
IsDBCSLeadByte
TerminateProcess
GetCurrentThread
CreateThread
Module32FirstW
GetCurrentProcessId
Module32NextW
SetStdHandle
OutputDebugStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
LoadLibraryExW
LoadLibraryW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetFileType
SetFilePointerEx
GetFileSizeEx
CheckRemoteDebuggerPresent
IsProcessorFeaturePresent
GetStdHandle
GetModuleFileNameW
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SetLastError
UnmapViewOfFile
IsDebuggerPresent
QueryPerformanceCounter
CreateDirectoryA
CreateProcessA
CloseHandle
Process32FirstW
DeleteFileA
QueryPerformanceFrequency
LoadLibraryA
CreateFileA
Process32NextW
GetFileAttributesA
GetLastError
GetTickCount64
GetTempPathA
Sleep
CreateToolhelp32Snapshot
OpenProcess
GetLocalTime
MapViewOfFile
CreateFileMappingA
GetFileSize
VirtualQuery
VirtualFree
VirtualAlloc
RemoveVectoredExceptionHandler
GetThreadContext
GetTickCount
VirtualAllocEx
ReadFile
SetFilePointer
GetSystemDirectoryA
VirtualFreeEx
IsWow64Process
GetSystemInfo
DuplicateHandle
HeapSize
HeapReAlloc
HeapFree
GetModuleHandleA
QueryFullProcessImageNameW
FreeLibrary
ExitProcess
AddVectoredExceptionHandler
GetProcAddress
UnhandledExceptionFilter
SetFileAttributesA
HeapAlloc
HeapDestroy
WaitForSingleObject
CreateMutexA
GetEnvironmentVariableA
WriteFile
GetCurrentProcess
VirtualProtect
GetProcessHeap
SetEndOfFile
WriteConsoleW
CreateFileW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetSystemTimePreciseAsFileTime
TryAcquireSRWLockExclusive
WaitForSingleObjectEx
GetExitCodeThread
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LocalFree
LCMapStringEx
GetStringTypeW
GetCPInfo
K32GetModuleInformation
RaiseException
user32
SetWindowsHookExA
PostThreadMessageA
PeekMessageW
DispatchMessageW
BringWindowToTop
UnregisterClassW
IsWindowVisible
DestroyWindow
GetWindowRect
PostMessageW
GetWindowThreadProcessId
UpdateWindow
TranslateMessage
FindWindowW
SetForegroundWindow
ShowWindow
PostQuitMessage
GetKeyState
GetMessageExtraInfo
GetCapture
ClientToScreen
TrackMouseEvent
GetKeyboardLayout
GetForegroundWindow
LoadCursorW
SetCapture
SetCursor
GetClientRect
IsWindowUnicode
ReleaseCapture
SetCursorPos
GetCursorPos
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
DefWindowProcW
CreateWindowExW
ScreenToClient
GetSystemMetrics
RegisterClassExW
UnregisterClassA
advapi32
OpenProcessToken
OpenThreadToken
GetTokenInformation
IsValidSid
GetLengthSid
CopySid
LookupAccountSidA
CryptDestroyKey
CryptAcquireContextA
RegCloseKey
RegQueryValueExA
CryptEncrypt
RegCreateKeyExA
CryptDecrypt
CryptCreateHash
CryptDeriveKey
CryptHashData
RegSetValueExA
CryptDestroyHash
RegOpenKeyExA
CryptReleaseContext
ConvertSidToStringSidA
shell32
SHGetFolderPathA
ShellExecuteW
ShellExecuteA
vmprotectsdk64
VMProtectBeginUltra
VMProtectEnd
VMProtectBeginMutation
wininet
InternetOpenUrlA
InternetCloseHandle
InternetReadFile
InternetOpenA
shlwapi
ord215
d3d11
D3D11CreateDeviceAndSwapChain
dwmapi
DwmSetWindowAttribute
imm32
ImmSetCandidateWindow
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
d3dcompiler_47
D3DCompile
userenv
UnloadUserProfile
ntdll
RtlVirtualUnwind
RtlCaptureContext
RtlPcToFileHeader
RtlUnwindEx
RtlLookupFunctionEntry
RtlUnwind
NtUnmapViewOfSection
NtCreateSection
NtMapViewOfSection
RtlImageNtHeader
NtClose
Name
.text
Size
53.8MB
Virtual Size
53.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
207KB
Virtual Size
206KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8.3MB
Virtual Size
8.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=184, id=261, version=33145,
count=27, id=260, version=33145,
count=20, id=259, version=33145,
count=7, productName=Unmarked objects (old),
count=10, id=259, version=35403,
count=17, id=260, version=35403,
count=2, id=257, productName=VS2015 UPD3.1 build 24215, version=24215,
count=27, id=257, version=33145,
count=267, id=1, productName=Unmarked objects,
count=95, id=261, version=35403,
count=11, id=265, version=35730,
count=1, id=255, version=35730,
count=1, id=258, version=35730,