antivmrefresh[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
antivmrefresh.exe
Size 91KB
Sample260710-tt2nescy6l
SHA256 c75a6e8cf663bc341b0621412b6fe4d52ca3748663a2243967666f4da93f1be9
MD5 c71e0e730c266c5d228b391318e7052b
SHA1 14ef79750ba87a0f3241976ea2c8c97d93aab1f0
SHA512 6958c727d2d574a2873059d2997dca67990664977565960d8d7375a0b846e40058f3178e9294ebda9735ae03e4537e3c5e730f4ebc5e8fd2599c3d8fede54cff
SSDEEP 1536:q6MnDQcNt+OgfXVlIV7Ic15nTO7hKIYXBf2:/MEcNtMUVdnTOFiXBe
TLSH
T137936D467B9420FBC9B6D13D9A829224F1B370B14B7A5FDB4904077D6A71AED3C3D288
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
antivmrefresh.exe

File Explorer

antivmrefresh.exe

.exe 91KB

antivmrefresh.exe

IMPHASH ed86ba8e18daf45104c3fa20d1a01f99
SHA256 c75a6e8cf663bc341b0621412b6fe4d52ca3748663a2243967666f4da93f1be9
MD5 c71e0e730c266c5d228b391318e7052b
SHA1 14ef79750ba87a0f3241976ea2c8c97d93aab1f0
SHA512 6958c727d2d574a2873059d2997dca67990664977565960d8d7375a0b846e40058f3178e9294ebda9735ae03e4537e3c5e730f4ebc5e8fd2599c3d8fede54cff
SSDEEP 1536:q6MnDQcNt+OgfXVlIV7Ic15nTO7hKIYXBf2:/MEcNtMUVdnTOFiXBe
TLSH
T137936D467B9420FBC9B6D13D9A829224F1B370B14B7A5FDB4904077D6A71AED3C3D288
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

70127

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\maldev\source\repos\antivmrefresh\x64\Debug\antivmrefresh.pdb

kernel32

HeapAlloc HeapFree GetProcessHeap IsDebuggerPresent GetProcAddress FreeLibrary RaiseException MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter VirtualQuery GetLastError GetModuleHandleW GetStartupInfoW GetCurrentThreadId

dxgi

CreateDXGIFactory

vcruntime140d

__current_exception_context __vcrt_GetModuleHandleW __std_type_info_destroy_list __C_specific_handler_noexcept __C_specific_handler __current_exception __vcrt_GetModuleFileNameW __vcrt_LoadLibraryExW memcpy

ucrtbased

_cexit _c_exit _exit _configthreadlocale _set_new_mode __p__commode strcpy_s strcat_s __stdio_common_vsprintf_s _seh_filter_dll _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit _crt_at_quick_exit __p___argv _wmakepath_s _wsplitpath_s wcscpy_s __p___argc exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv __setusermatherr _set_app_type _seh_filter_exe _CrtDbgReportW _CrtDbgReport __stdio_common_vfprintf __acrt_iob_func terminate _set_fmode _register_thread_local_exe_atexit_callback

Name

.textbss

Size

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

40KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

776B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

512B

Virtual Size

457B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

719B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

antivmrefresh.exe

kernel32

dxgi

vcruntime140d

ucrtbased

generic