04724cfae2ff581e06df3492dae42eebf3430bbdcbd2c0d4ae275d7e8845e70d

Sharing

Copy URL Twitter E-mail

General

Target
04724cfae2ff581e06df3492dae42eebf3430bbdcbd2c0d4ae275d7e8845e70d
Size 14.1MB
Sample260709-y2vbjaas4y
SHA256 04724cfae2ff581e06df3492dae42eebf3430bbdcbd2c0d4ae275d7e8845e70d
MD5 308621b5aeefc538843dbc3d379c90d3
SHA1 6aebdcb0835149e8b0430881add6730fa1f22c62
SHA512 5b104e0d78aca7716ab291b1c9f34a4ebbb1aa17a0426f81a4d2fa49917cdf83787d73d929cd5854dd3559ee53fb25692ee6a060400bbdf3cf54cf30ade997ac
SSDEEP 393216:MB6rBtb9jeYWWSyw8F+q5Z5618WqBYdxNhaCxRvrK8:MCBtxj9f+e76LqedxNr/
TLSH
T1D9E633EC7288331DC02AC9349513AE58F3B5482E1BD598AF75D7FF806B6B465E602F12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
04724cfae2ff581e06df3492dae42eebf3430bbdcbd2c0d4ae275d7e8845e70d

File Explorer

04724cfae2ff581e06df3492dae42eebf3430bbdcbd2c0d4ae275d7e8845e70d

.exe 14.1MB

04724cfae2ff581e06df3492dae42eebf3430bbdcbd2c0d4ae275d7e8845e70d

IMPHASH 0789d55c0b700fc6369fc9bea01529b5
SHA256 04724cfae2ff581e06df3492dae42eebf3430bbdcbd2c0d4ae275d7e8845e70d
MD5 308621b5aeefc538843dbc3d379c90d3
SHA1 6aebdcb0835149e8b0430881add6730fa1f22c62
SHA512 5b104e0d78aca7716ab291b1c9f34a4ebbb1aa17a0426f81a4d2fa49917cdf83787d73d929cd5854dd3559ee53fb25692ee6a060400bbdf3cf54cf30ade997ac
SSDEEP 393216:MB6rBtb9jeYWWSyw8F+q5Z5618WqBYdxNhaCxRvrK8:MCBtxj9f+e76LqedxNr/
TLSH
T1D9E633EC7288331DC02AC9349513AE58F3B5482E1BD598AF75D7FF806B6B465E602F12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14795669

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

Virtual Size

194KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gehcont

Size

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vmp0

Size

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

14.1MB

Virtual Size

14.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

13.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

04724cfae2ff581e06df3492dae42eebf3430bbdcbd2c0d4ae275d7e8845e70d

kernel32

user32

advapi32

shell32

shlwapi

generic