UN[.]vmp[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
UN.vmp.exe
Size 4.8MB
Sample260728-ejmdeseg96
SHA256 a38d39879c54266de4361c4368849c32038b1f1d5ab8dcbe5bfd59f6d3973dd8
MD5 51a0604a348d10221a67709044317715
SHA1 75805017f02cc599fc9793c8b14d11adab7cfb07
SHA512 cee3b45539d8aae392aa38c44ecd08cae1761eb1c8f5fd9aeb974541e505a5d6ec3909c7379d5a5bfceadbce63287504da11ab533323484528bc4b4ae290600a
SSDEEP 98304:zIi6BUMMuQK9xJGgRjpYLzffunaXRLOo4SSZ2I7dCNQ:zIiOMa9qgRjyunaBXycQ
TLSH
T134363393A52F4BF6C98A49B4C2C10945B3F671940B89266D37CCBDE93B809178F6E347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
UN.vmp.exe

File Explorer

UN.vmp.exe

.exe 4.8MB

UN.vmp.exe

IMPHASH 805856f135b2b7ff27cf268c91675e64
SHA256 a38d39879c54266de4361c4368849c32038b1f1d5ab8dcbe5bfd59f6d3973dd8
MD5 51a0604a348d10221a67709044317715
SHA1 75805017f02cc599fc9793c8b14d11adab7cfb07
SHA512 cee3b45539d8aae392aa38c44ecd08cae1761eb1c8f5fd9aeb974541e505a5d6ec3909c7379d5a5bfceadbce63287504da11ab533323484528bc4b4ae290600a
SSDEEP 98304:zIi6BUMMuQK9xJGgRjpYLzffunaXRLOo4SSZ2I7dCNQ:zIiOMa9qgRjyunaBXycQ
TLSH
T134363393A52F4BF6C98A49B4C2C10945B3F671940B89266D37CCBDE93B809178F6E347
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9636709

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d9

Direct3DCreate9

kernel32

CreateToolhelp32Snapshot GetCurrentProcess LocalAlloc GetCurrentProcess GetCurrentThread LocalFree GetModuleFileNameW GetProcessAffinityMask SetProcessAffinityMask SetThreadAffinityMask Sleep ExitProcess GetLastError FreeLibrary LoadLibraryA GetModuleHandleA GetProcAddress

user32

MessageBoxA CharUpperBuffW

gdi32

GetDeviceCaps

advapi32

CryptEncrypt RegQueryValueExA OpenSCManagerW EnumServicesStatusExW OpenServiceW QueryServiceConfigW CloseServiceHandle

shell32

ShellExecuteA

msvcp140

?_Xbad_function_call@std@@YAXXZ

imm32

ImmReleaseContext

ntdll

RtlImageNtHeader

normaliz

IdnToAscii

wldap32

ord46

crypt32

CertFreeCertificateChainEngine

ws2_32

connect

psapi

GetModuleInformation

userenv

UnloadUserProfile

vcruntime140

__current_exception

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

strncmp

api-ms-win-crt-heap-l1-1-0

calloc

api-ms-win-crt-stdio-l1-1-0

_pclose

api-ms-win-crt-filesystem-l1-1-0

_unlock_file

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-runtime-l1-1-0

exit

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-locale-l1-1-0

localeconv

wtsapi32

WTSSendMessageW

Name

.text

Size

Virtual Size

860KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

195KB

Virtual Size

195KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

428KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vmp0

Size

Virtual Size

3.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

4.6MB

Virtual Size

4.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

UN.vmp.exe

d3d9

kernel32

user32

gdi32

advapi32

shell32

msvcp140

imm32

ntdll

normaliz

wldap32

crypt32

ws2_32

psapi

userenv

vcruntime140

vcruntime140_1

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

wtsapi32

generic