网易邮箱小号鸡[.]exe

General

Target
网易邮箱小号鸡.exe
Size 6.3MB
Sample260801-zxt1msgl21
SHA256 6636dac777c2f5a266a0916ae3bef6bb8153acf8627e21c654aa1e85f3568b39
MD5 b786bc21f2f782a5706fc9bce9bf0832
SHA1 4db92b3df39e9f46d56e3a75e54b2190ebf4d2ce
SHA512 53b05835b4defd322b3bf87401c321cb18ee85be875de19ec5bf4293a65fdd6750c62d44ad92e889f582744254554fd5595f8e3002023bde16a8c81f04d35182
SSDEEP 98304:+ltvgJyw85xqafCjHgQMfWkOelW8DWhuztqNvwxIdEbE/bE/Jv4Dy:+ltvg4w85ZKgQRcBqhmId8E/Y/xKy
TLSH
T1E06633F6D88E9C29D9C92237F8102469CE301F2852D0912FF7F8EF55627E39A3B49156
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
网易邮箱小号鸡.exe

File Explorer

网易邮箱小号鸡.exe

.exe 6.3MB

网易邮箱小号鸡.exe

IMPHASH 58c72759a9f468c1e16487a77dbeb20f
SHA256 6636dac777c2f5a266a0916ae3bef6bb8153acf8627e21c654aa1e85f3568b39
MD5 b786bc21f2f782a5706fc9bce9bf0832
SHA1 4db92b3df39e9f46d56e3a75e54b2190ebf4d2ce
SHA512 53b05835b4defd322b3bf87401c321cb18ee85be875de19ec5bf4293a65fdd6750c62d44ad92e889f582744254554fd5595f8e3002023bde16a8c81f04d35182
SSDEEP 98304:+ltvgJyw85xqafCjHgQMfWkOelW8DWhuztqNvwxIdEbE/bE/Jv4Dy:+ltvg4w85ZKgQRcBqhmId8E/Y/xKy
TLSH
T1E06633F6D88E9C29D9C92237F8102469CE301F2852D0912FF7F8EF55627E39A3B49156
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

14726290

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

shell32

ShellExecuteA

user32

DrawEdge

kernel32

RemoveDirectoryA GetModuleFileNameW GetModuleHandleA LoadLibraryA LocalAlloc LocalFree GetModuleFileNameA ExitProcess

advapi32

LookupPrivilegeValueA

ole32

CoUninitialize

crypt32

CryptStringToBinaryA

shlwapi

PathRemoveBlanksA

wtsapi32

WTSEnumerateProcessesA

wininet

InternetCloseHandle

dbghelp

MakeSureDirectoryPathExists

iphlpapi

IcmpCloseHandle

ws2_32

gethostname

gdi32

SetBkMode

winmm

midiStreamOut

version

GetFileVersionInfoSizeA

psapi

EnumProcesses

setupapi

SetupDiGetClassDevsA

oleaut32

SafeArrayGetDim

winhttp

WinHttpTimeFromSystemTime

comdlg32

GetFileTitleA

powrprof

SetSuspendState

winspool.drv

DocumentPropertiesA

comctl32

ord17

oledlg

ord8

rasapi32

RasGetConnectStatusA

Name

.text

Size

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

4.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

812KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp1

Size

6.3MB

Virtual Size

6.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

网易邮箱小号鸡.exe

shell32

user32

kernel32

advapi32

ole32

crypt32

shlwapi

wtsapi32

wininet

dbghelp

iphlpapi

ws2_32

gdi32

winmm

version

psapi

setupapi

oleaut32

winhttp

comdlg32

powrprof

winspool.drv

comctl32

oledlg

rasapi32

generic