f6c6b2856b7f8568b3df2923fccaf139a388810cbfd9df1a57e57dcbf6681c55

Sharing

Copy URL Twitter E-mail

General

Target
f6c6b2856b7f8568b3df2923fccaf139a388810cbfd9df1a57e57dcbf6681c55
Size 7.3MB
Sample260722-cg45cack7v
SHA256 f6c6b2856b7f8568b3df2923fccaf139a388810cbfd9df1a57e57dcbf6681c55
MD5 d959efe7df4e1b5431c1712c8c9137f0
SHA1 fcb465aa26f43d17d4310fa7e28bca4fa1fccd5a
SHA512 075ac1ed9a758dd0317dbbf274af654a5b88d5f218a736fc1b4e6e7521eed07e02c88e2824c8c04b46bd363921249c4a72693793df8952818b2d014f02c20cea
SSDEEP 196608:gyq3C3/xj8dN0hDd6GFrgcxs8g0Yu1cCwq/plcX4/LrZHzYK:xq3C3p8Ih5RKcxs8MuyCwkeaLrh
TLSH
T1CE763337562A2084E8E8C839D637FDC572F743AACB409479BDE698C122178E5D723D87
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f6c6b2856b7f8568b3df2923fccaf139a388810cbfd9df1a57e57dcbf6681c55

File Explorer

f6c6b2856b7f8568b3df2923fccaf139a388810cbfd9df1a57e57dcbf6681c55

.exe 7.3MB

f6c6b2856b7f8568b3df2923fccaf139a388810cbfd9df1a57e57dcbf6681c55

IMPHASH 2fa9f448d9c22619e3ccb241bc946b44
SHA256 f6c6b2856b7f8568b3df2923fccaf139a388810cbfd9df1a57e57dcbf6681c55
MD5 d959efe7df4e1b5431c1712c8c9137f0
SHA1 fcb465aa26f43d17d4310fa7e28bca4fa1fccd5a
SHA512 075ac1ed9a758dd0317dbbf274af654a5b88d5f218a736fc1b4e6e7521eed07e02c88e2824c8c04b46bd363921249c4a72693793df8952818b2d014f02c20cea
SSDEEP 196608:gyq3C3/xj8dN0hDd6GFrgcxs8g0Yu1cCwq/plcX4/LrZHzYK:xq3C3p8Ih5RKcxs8MuyCwkeaLrh
TLSH
T1CE763337562A2084E8E8C839D637FDC572F743AACB409479BDE698C122178E5D723D87
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

680456520

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

_cJSONUtils_AddPatchToArray@16 _cJSONUtils_ApplyPatches@8 _cJSONUtils_ApplyPatchesCaseSensitive@8 _cJSONUtils_FindPointerFromObjectTo@8 _cJSONUtils_GenerateMergePatch@8 _cJSONUtils_GenerateMergePatchCaseSensitive@8 _cJSONUtils_GeneratePatches@8 _cJSONUtils_GeneratePatchesCaseSensitive@8 _cJSONUtils_GetPointer@8 _cJSONUtils_GetPointerCaseSensitive@8 _cJSONUtils_MergePatch@8 _cJSONUtils_MergePatchCaseSensitive@8 _cJSONUtils_SortObject@4 _cJSONUtils_SortObjectCaseSensitive@4 _cJSON_AddArrayToObject@8 _cJSON_AddBoolToObject@12 _cJSON_AddFalseToObject@8 _cJSON_AddItemReferenceToArray@8 _cJSON_AddItemReferenceToObject@12 _cJSON_AddItemToArray@8 _cJSON_AddItemToObject@12 _cJSON_AddItemToObjectCS@12 _cJSON_AddNullToObject@8 _cJSON_AddNumberToObject@16 _cJSON_AddObjectToObject@8 _cJSON_AddRawToObject@12 _cJSON_AddStringToObject@12 _cJSON_AddTrueToObject@8 _cJSON_Compare@12 _cJSON_CreateArray@0 _cJSON_CreateArrayReference@4 _cJSON_CreateBool@4 _cJSON_CreateDoubleArray@8 _cJSON_CreateFalse@0 _cJSON_CreateFloatArray@8 _cJSON_CreateIntArray@8 _cJSON_CreateNull@0 _cJSON_CreateNumber@8 _cJSON_CreateObject@0 _cJSON_CreateObjectReference@4 _cJSON_CreateRaw@4 _cJSON_CreateString@4 _cJSON_CreateStringArray@8 _cJSON_CreateStringReference@4 _cJSON_CreateTrue@0 _cJSON_Delete@4 _cJSON_DeleteItemFromArray@8 _cJSON_DeleteItemFromObject@8 _cJSON_DeleteItemFromObjectCaseSensitive@8 _cJSON_DetachItemFromArray@8 _cJSON_DetachItemFromObject@8 _cJSON_DetachItemFromObjectCaseSensitive@8 _cJSON_DetachItemViaPointer@8 _cJSON_Duplicate@8 _cJSON_GetArrayItem@8 _cJSON_GetArraySize@4 _cJSON_GetErrorPtr@0 _cJSON_GetNumberValue@4 _cJSON_GetObjectItem@8 _cJSON_GetObjectItemCaseSensitive@8 _cJSON_GetStringValue@4 _cJSON_HasObjectItem@8 _cJSON_InitHooks@4 _cJSON_InsertItemInArray@12 _cJSON_IsArray@4 _cJSON_IsBool@4 _cJSON_IsFalse@4 _cJSON_IsInvalid@4 _cJSON_IsNull@4 _cJSON_IsNumber@4 _cJSON_IsObject@4 _cJSON_IsRaw@4 _cJSON_IsString@4 _cJSON_IsTrue@4 _cJSON_Minify@4 _cJSON_Parse@4 _cJSON_ParseWithLength@8 _cJSON_ParseWithLengthOpts@16 _cJSON_ParseWithOpts@12 _cJSON_Print@4 _cJSON_PrintBuffered@12 _cJSON_PrintPreallocated@16 _cJSON_PrintUnformatted@4 _cJSON_ReplaceItemInArray@12 _cJSON_ReplaceItemInObject@12 _cJSON_ReplaceItemInObjectCaseSensitive@12 _cJSON_ReplaceItemViaPointer@12 _cJSON_SetNumberHelper@12 _cJSON_SetValuestring@8 _cJSON_Version@0 _cJSON_free@4 _cJSON_malloc@4

Name

.text

Size

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

270KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

642.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

7.2MB

Virtual Size

7.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

145KB

Virtual Size

145KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

f6c6b2856b7f8568b3df2923fccaf139a388810cbfd9df1a57e57dcbf6681c55

ddraw

dsound

winmm

dinput

wsock32

lua51

kernel32

user32

gdi32

advapi32

shell32

ole32

netapi32

libeay32

iphlpapi

imm32

wtsapi32

generic