main[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
main.zip
Size 2.0MB
Sample260804-xd26ssck4y
SHA256 1e4395a599e0082c5c435d78dfe53c403fa59d21c9fe4b83ad7d5320ccfa7fd0
MD5 08d44c500f9d0aaed4f2e395285f1c78
SHA1 8e09c40345457373f8cb6df587c95f66aef3cf20
SHA512 101797ff07791cb77544ebe8350234e5095cd24c22afe28eda22ca385d9d621f118d44ae5f0626d906a3233272854648a98fb563f4c098c34ff6b229aaa37d02
SSDEEP 49152:LMM/4zBOTezuiUtDXWxvEbYfIM2cbM9bOXYfh9pL6fe7c2:X4z23bDAEbYQVbOoLx6f+b
TLSH
T11BA5337782C2731D6C4165E3F983ABD8ED4C7941868936EE51B0CCF64203669CE98B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

vmprotect themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
static1/unpack001/main/main.exe	themida

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
static1/unpack001/main/main.exe	vmprotect

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/main/amdgpio3.sys
unpack001/main/main.exe

File Explorer

main.zip

.zip 2.0MB
main/amdgpio3.sys

.sys 32KB
main/main.exe

.exe 2.7MB

main.zip

SHA256 1e4395a599e0082c5c435d78dfe53c403fa59d21c9fe4b83ad7d5320ccfa7fd0
MD5 08d44c500f9d0aaed4f2e395285f1c78
SHA1 8e09c40345457373f8cb6df587c95f66aef3cf20
SHA512 101797ff07791cb77544ebe8350234e5095cd24c22afe28eda22ca385d9d621f118d44ae5f0626d906a3233272854648a98fb563f4c098c34ff6b229aaa37d02
SSDEEP 49152:LMM/4zBOTezuiUtDXWxvEbYfIM2cbM9bOXYfh9pL6fe7c2:X4z23bDAEbYQVbOoLx6f+b
TLSH
T11BA5337782C2731D6C4165E3F983ABD8ED4C7941868936EE51B0CCF64203669CE98B9E
MD5 SHA1 SHA512 SSDEEP TLSH

main/amdgpio3.sys

IMPHASH 497428795d7b5ecf366234e283137ed6
SHA256 0422d184e8bdae44fd1daefc6e712fcad06295bbdc8d80565806c27e95be3e51
MD5 86a0ac35353119bcf30a37473efe5555
SHA1 3adde4c4763f256b114daea67d35ed2614c3b66f
SHA512 fac45aeab430fe54790fccd5f27a45f9c75cfbb2ee325585211fe0fe1a297d8eaeb979700a6f528acbbf1de15959cdaeceb80d2d53521d105b40513f5ff33d11
SSDEEP 384:Bo/CvvVw0qFWx0L2KU+onoISBbPL3nVSonVqFRZ2lmTx4uImQSDDi7FRkcWwlTI9:BeCHVrqWwUxknVMNTVDDi/+GB
TLSH
T137E26CC19A7864C3EE839D7053E8EA977C38F3C31950841D11EAE5E50D83BD6BB1852E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5920

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\AM3306_GPIO_Driver\Win8\simgpio\x64\Win8.1Release\amdgpio3.pdb

Name

.text

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1024B

Virtual Size

668B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

512B

Virtual Size

204B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

PAGE

Size

512B

Virtual Size

99B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

1024B

Virtual Size

776B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

36B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

main/main.exe

IMPHASH efd366d511dbb6a89c4e5eabc2d4f8ff
SHA256 b6aadf55a7940a4758171df31999294b5f55860afa883a41c7a0cec9297d68f3
MD5 f2d9dcdafa96b9bf6359050e7c9d11a2
SHA1 d18aa8c5d7047bec2425f13db1d42684a7337a1d
SHA512 9272c0591a40bb42b06ac01c2814e4298692175cb5c1b5b7953a41b4328c5cdb6d3637af2a69033acf8d620d6418e93eaec6ab589a1597ac687d2df6b3ae5784
SSDEEP 49152:k2JB2RzBfuALaAXxvu4v9hZWAnEadCOADb2KKBTiVniK+bcpMn:+TxLaAB79Hdaf2NYdd+m
TLSH
T131D50264F2F501E9E07A8178E9665E0BDA727C540730ABDF23A009A71F63BD11B7E712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

385568

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

winhttp

WinHttpCrackUrl WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpSetTimeouts WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse

wintrust

WinVerifyTrust

dwmapi

DwmSetWindowAttribute

crypt32

CryptBinaryToStringA

advapi32

OpenSCManagerW AllocateAndInitializeSid AdjustTokenPrivileges SystemFunction036 CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextA QueryServiceStatusEx OpenServiceW CheckTokenMembership CloseServiceHandle RegQueryValueExW RegOpenKeyExW RegCloseKey LookupPrivilegeValueA FreeSid OpenProcessToken

user32

TranslateMessage ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout GetClipboardData LoadCursorA MessageBoxA UpdateWindow GetSystemMetrics EmptyClipboard SetClipboardData CloseClipboard OpenClipboard ShowWindow DestroyWindow CreateWindowExW RegisterClassExW UnregisterClassW PostQuitMessage DefWindowProcA PeekMessageW DispatchMessageW

kernel32

GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle HeapSize SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers OutputDebugStringW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW LoadLibraryExW VirtualProtect HeapFree HeapAlloc UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext WriteFile IsProcessorFeaturePresent ReadFile WriteConsoleW GetFileType GetStdHandle FreeLibraryAndExitThread ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc CreateFileW GetVolumeInformationA IsDebuggerPresent CloseHandle DeviceIoControl Sleep GetCurrentProcess GetCurrentProcessId SetEndOfFile TerminateProcess OpenProcess GetSystemInfo GetTickCount GetSystemDirectoryW VirtualAlloc VirtualFree VirtualQueryEx ReadProcessMemory WriteProcessMemory GetCommandLineA GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress LoadLibraryA GlobalAlloc GlobalUnlock GlobalLock MultiByteToWideChar CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW Module32NextW GlobalFree WideCharToMultiByte QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary RtlPcToFileHeader RaiseException GetSystemTimePreciseAsFileTime GetLastError WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetTickCount64 InitOnceBeginInitialize InitOnceComplete FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead SetLastError GetOEMCP GetACP IsValidCodePage FindFirstFileExW FindNextFileW FindClose HeapReAlloc GetSystemWow64DirectoryW GetFileSizeEx ExitProcess GetLocaleInfoA RtlLookupFunctionEntry RtlUnwindEx

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

gdi32

GetStockObject

d3dcompiler_47

D3DCompile

Name

.text

Size

569KB

Virtual Size

568KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

10.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vmp0

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.themida

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.upx0

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.upx1

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

main.zip

main/amdgpio3.sys

ntoskrnl.exe

wdfldr.sys

generic

main/main.exe

d3d11

winhttp

wintrust

dwmapi

crypt32

advapi32

user32

kernel32

imm32

gdi32

d3dcompiler_47

generic