soul[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
soul.exe
Size 8.6MB
Sample260728-e7mdbsbj2t
SHA256 bf17f35ff86e9c5611c24fbc06ca352f031c7b5c904a23ad985fecf6304554c2
MD5 96e1ddef4128b44c142b686044ddcf70
SHA1 094acc3f4e963498c832875272e74060b7b9d84b
SHA512 e1457df513ed82126516e66ab38f4a8fe0c4070b37c56dfac4243c1fc261deea92207bf095cbee52c6ef8be3afb01ab98c4694506aee8c40ae6f0aa968006f3a
SSDEEP 196608:sGsDpBgHH5lZFmy57xaZdWNt/AUWO4Ag8Nz9OQtWb1:sGstenFx5lavuY+4Pwz9Oca1
TLSH
T1269623ED7184379CC06AC8389533FD09B2B2621F0AE6D5BD72CF7A807B5E414D986B61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
soul.exe

File Explorer

soul.exe

.exe 8.6MB

soul.exe

IMPHASH 3a32ac7b5d2d0904524841a38c7cbed3
SHA256 bf17f35ff86e9c5611c24fbc06ca352f031c7b5c904a23ad985fecf6304554c2
MD5 96e1ddef4128b44c142b686044ddcf70
SHA1 094acc3f4e963498c832875272e74060b7b9d84b
SHA512 e1457df513ed82126516e66ab38f4a8fe0c4070b37c56dfac4243c1fc261deea92207bf095cbee52c6ef8be3afb01ab98c4694506aee8c40ae6f0aa968006f3a
SSDEEP 196608:sGsDpBgHH5lZFmy57xaZdWNt/AUWO4Ag8Nz9OQtWb1:sGstenFx5lavuY+4Pwz9Oca1
TLSH
T1269623ED7184379CC06AC8389533FD09B2B2621F0AE6D5BD72CF7A807B5E414D986B61
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

17129339

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

crypt32

CertCloseStore

wintrust

WinVerifyTrust

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

advapi32

CryptCreateHash

psapi

GetModuleInformation

ws2_32

WSAStartup

kernel32

WakeAllConditionVariable FlsSetValue LocalAlloc LocalFree GetModuleFileNameW GetProcessAffinityMask SetProcessAffinityMask SetThreadAffinityMask Sleep ExitProcess FreeLibrary LoadLibraryA GetModuleHandleA GetProcAddress

user32

MonitorFromPoint GetProcessWindowStation GetProcessWindowStation GetUserObjectInformationW

gdi32

GetPixel

shell32

ShellExecuteA

ole32

CoCreateFreeThreadedMarshaler

msvcp140

_Xtime_get_ticks

ntdll

ZwWriteVirtualMemory

dwmapi

DwmUnregisterThumbnail

imm32

ImmSetCompositionWindow

shlwapi

PathFindFileNameW

userenv

UnloadUserProfile

winmm

timeEndPeriod

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context

api-ms-win-crt-stdio-l1-1-0

fseek

api-ms-win-crt-heap-l1-1-0

malloc

api-ms-win-crt-math-l1-1-0

roundf

api-ms-win-crt-convert-l1-1-0

strtoul

api-ms-win-crt-string-l1-1-0

isxdigit

api-ms-win-crt-runtime-l1-1-0

_errno

api-ms-win-crt-filesystem-l1-1-0

_unlock_file

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-time-l1-1-0

strftime

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

oleaut32

SysFreeString

wtsapi32

WTSSendMessageW

Name

.text

Size

Virtual Size

5.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vmp0

Size

Virtual Size

3.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

8.6MB

Virtual Size

8.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

216B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

soul.exe

crypt32

wintrust

d3d11

d3dcompiler_47

advapi32

psapi

ws2_32

kernel32

user32

gdi32

shell32

ole32

msvcp140

ntdll

dwmapi

imm32

shlwapi

userenv

winmm

bcrypt

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

oleaut32

wtsapi32

generic