fff[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
fff.exe
Size 25.0MB
Sample260804-a6whdsac98
SHA256 d92ab21f636b73204c95223079d6dcbe1f37fe76e9d60a2ae1a9dfeecc4c6c3a
MD5 3bc15a6b899e7ab6e89436d0a1ad9683
SHA1 42a86e21c952227ca452b7b216ae06c94f1c15a4
SHA512 93cba4f05a04253a9842ceb228b469dd760a06e9c671504aa19379d0e318cf035251abd3c1a4a030c7bdd3e95f384214d3922e092f0be5f39d9dd2d9e0d9fb93
SSDEEP 393216:B2KXK2JB7wfAlJXIlbgWXLf6sOMy1z8qRVyuPgIK/ZXsz8cexoIhsuK:B2j2JKATIFfPy1z3dPg5idIh
TLSH
T192472357E8D6A3D8DB830F40D68A25DA13D171BF8ADE981D27CE2C023431D6B8A85D77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fff.exe

File Explorer

fff.exe

.exe 25.0MB

fff.exe

IMPHASH 268bf8d64c662e997d565125592c216a
SHA256 d92ab21f636b73204c95223079d6dcbe1f37fe76e9d60a2ae1a9dfeecc4c6c3a
MD5 3bc15a6b899e7ab6e89436d0a1ad9683
SHA1 42a86e21c952227ca452b7b216ae06c94f1c15a4
SHA512 93cba4f05a04253a9842ceb228b469dd760a06e9c671504aa19379d0e318cf035251abd3c1a4a030c7bdd3e95f384214d3922e092f0be5f39d9dd2d9e0d9fb93
SSDEEP 393216:B2KXK2JB7wfAlJXIlbgWXLf6sOMy1z8qRVyuPgIK/ZXsz8cexoIhsuK:B2j2JKATIFfPy1z3dPg5idIh
TLSH
T192472357E8D6A3D8DB830F40D68A25DA13D171BF8ADE981D27CE2C023431D6B8A85D77
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

35472214

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpAddRequestHeaders

bcrypt

BCryptCloseAlgorithmProvider

crypt32

CryptUnprotectData

iphlpapi

GetAdaptersInfo

advapi32

CryptAcquireContextW

kernel32

InitOnceBeginInitialize

user32

TranslateMessage

gdi32

CreateRectRgn

shell32

ShellExecuteW

ole32

CoTaskMemFree

msvcp140

?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ

dwmapi

DwmSetWindowAttribute

d3d11

D3D11CreateDeviceAndSwapChain

imm32

ImmReleaseContext

d3dcompiler_47

D3DCompile

vcruntime140

__C_specific_handler

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

_set_app_type

api-ms-win-crt-heap-l1-1-0

malloc

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf

api-ms-win-crt-filesystem-l1-1-0

_lock_file

api-ms-win-crt-math-l1-1-0

acosf

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

217KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vmp0

Size

Virtual Size

16.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp2

Size

25.0MB

Virtual Size

25.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

469B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

164B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

fff.exe

winhttp

bcrypt

crypt32

iphlpapi

advapi32

kernel32

user32

gdi32

shell32

ole32

msvcp140

dwmapi

d3d11

imm32

d3dcompiler_47

vcruntime140

vcruntime140_1

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic