YuB-X-Injector[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
YuB-X-Injector.exe
Size 5.2MB
Sample260718-237j2aez6p
SHA256 a63d2a4048d89b8b65c6c6f2b19aa85f054ca497839ca50cdbc36b53837757ed
MD5 899fbd7c1522e63956fffc4e32db77c9
SHA1 1ab5f6ff08a42cd2492d477954740b95c193c856
SHA512 aa5a7b09241925c48a2eae987298c85aac52e1b5d6c416ef95fe47889d088606aad3092dbecc659547971da8a64803362a97eb6f8a5698f2c92d00971b07f5cf
SSDEEP 98304:x96f85T0I1vWQ44lUJK2Kz4HoXz9IkOSyN634L30zLIgrETUDh6HDJQA3ehwCmWD:ny85oI1vzcdKzJ1dyNMpIg7ClWwCzD
TLSH
T19B4622AC6108371CC09EC0744933FD49A2B6DA2E53E9B4AEB1DB7B9173EF424E506B45
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
YuB-X-Injector.exe

File Explorer

YuB-X-Injector.exe

.exe 5.2MB

YuB-X-Injector.exe

IMPHASH d40829ffb6264208db60a822c988cc34
SHA256 a63d2a4048d89b8b65c6c6f2b19aa85f054ca497839ca50cdbc36b53837757ed
MD5 899fbd7c1522e63956fffc4e32db77c9
SHA1 1ab5f6ff08a42cd2492d477954740b95c193c856
SHA512 aa5a7b09241925c48a2eae987298c85aac52e1b5d6c416ef95fe47889d088606aad3092dbecc659547971da8a64803362a97eb6f8a5698f2c92d00971b07f5cf
SSDEEP 98304:x96f85T0I1vWQ44lUJK2Kz4HoXz9IkOSyN634L30zLIgrETUDh6HDJQA3ehwCmWD:ny85oI1vzcdKzJ1dyNMpIg7ClWwCzD
TLSH
T19B4622AC6108371CC09EC0744933FD49A2B6DA2E53E9B4AEB1DB7B9173EF424E506B45
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Password

123

Minor OS version

Major OS version

Entry point

7061216

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

912B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vmp0

Size

Virtual Size

3.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

5.2MB

Virtual Size

5.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

220B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

469B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

YuB-X-Injector.exe

kernel32

user32

advapi32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

wtsapi32

generic