24d436963c97edb312a201732a6accfaf7bec74ec1ad3af21e7da2c93ead77af

General

Target
24d436963c97edb312a201732a6accfaf7bec74ec1ad3af21e7da2c93ead77af
Size 5.6MB
Sample260731-ql79fstekf
SHA256 24d436963c97edb312a201732a6accfaf7bec74ec1ad3af21e7da2c93ead77af
MD5 8aaac60a96523453d05b7d4026a76d0e
SHA1 a784ab556730dbf5069a821f59cca66e7687e907
SHA512 05af361461807832ffaf2e3ed566c419f4940b51b74d548148d7d05b573115e2364d8c6350184e585fd4e499faba2f87df6570b8c8330c6c1ddee99bb82fb408
SSDEEP 98304:vi11LEbb3/xi1D1uFB2W8NSOfibhFmrC+5lxJdtxX5/tTLnqbN/a:vi11LEf8DTNSOfoHmdzxJdvX5lTeb5a
TLSH
T11D4633481F979946C5792F3A4CA9E67D0BFC0F153C089BB2E4017BC8E9339C4B9671A9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
24d436963c97edb312a201732a6accfaf7bec74ec1ad3af21e7da2c93ead77af

File Explorer

24d436963c97edb312a201732a6accfaf7bec74ec1ad3af21e7da2c93ead77af

.exe 5.6MB

24d436963c97edb312a201732a6accfaf7bec74ec1ad3af21e7da2c93ead77af

IMPHASH da9247282b67820bc537c8da890eeb0b
SHA256 24d436963c97edb312a201732a6accfaf7bec74ec1ad3af21e7da2c93ead77af
MD5 8aaac60a96523453d05b7d4026a76d0e
SHA1 a784ab556730dbf5069a821f59cca66e7687e907
SHA512 05af361461807832ffaf2e3ed566c419f4940b51b74d548148d7d05b573115e2364d8c6350184e585fd4e499faba2f87df6570b8c8330c6c1ddee99bb82fb408
SSDEEP 98304:vi11LEbb3/xi1D1uFB2W8NSOfibhFmrC+5lxJdtxX5/tTLnqbN/a:vi11LEf8DTNSOfoHmdzxJdvX5lTeb5a
TLSH
T11D4633481F979946C5792F3A4CA9E67D0BFC0F153C089BB2E4017BC8E9339C4B9671A9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

11757764

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

Virtual Size

642KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

5.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

433KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

5.2MB

Virtual Size

5.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

276B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

364KB

Virtual Size

363KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

24d436963c97edb312a201732a6accfaf7bec74ec1ad3af21e7da2c93ead77af

winmm

ws2_32

rasapi32

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

wininet

comdlg32

wtsapi32

generic

Sharing

General

Malware Config

Signatures

File Explorer

24d436963c97edb312a201732a6accfaf7bec74ec1ad3af21e7da2c93ead77af

winmm

ws2_32

rasapi32

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

wininet

comdlg32

wtsapi32

generic