2e8467e7a43f7081a31ce9016e9c6230b5b5f314850a205179b8d437b4c79cba

General

Target
2e8467e7a43f7081a31ce9016e9c6230b5b5f314850a205179b8d437b4c79cba
Size 3.8MB
Sample260804-ymc4psdk6t
SHA256 2e8467e7a43f7081a31ce9016e9c6230b5b5f314850a205179b8d437b4c79cba
MD5 a03fde8c84ad67ca2ff515bad23f6b1d
SHA1 1be69ea16c0c32584c159d3c4c3540e16cf57617
SHA512 58038950b04fcb30a650093b0dab096a4c17e5829a043842c1bceea729122e8db910a7c0c7f49f5d85febd893168b4f815a6dc5ad32f8974a9d3706d2ae1b7d1
SSDEEP 98304:CgRauSBBA/DjlXJ9DQuZGRoYL6MXBLMVU6di87Tv4DLaexFI:/s9GJ9cuZGJBLMNdD4HaeI
TLSH
T1720633E01AC1AD4DD3F5A1381733FE2E4B64D023BB544686A95433D5FA2E6D2353E0B6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2e8467e7a43f7081a31ce9016e9c6230b5b5f314850a205179b8d437b4c79cba

File Explorer

2e8467e7a43f7081a31ce9016e9c6230b5b5f314850a205179b8d437b4c79cba

.exe 3.8MB

2e8467e7a43f7081a31ce9016e9c6230b5b5f314850a205179b8d437b4c79cba

IMPHASH 061e5f1c6e7136607840516dfdd7d546
SHA256 2e8467e7a43f7081a31ce9016e9c6230b5b5f314850a205179b8d437b4c79cba
MD5 a03fde8c84ad67ca2ff515bad23f6b1d
SHA1 1be69ea16c0c32584c159d3c4c3540e16cf57617
SHA512 58038950b04fcb30a650093b0dab096a4c17e5829a043842c1bceea729122e8db910a7c0c7f49f5d85febd893168b4f815a6dc5ad32f8974a9d3706d2ae1b7d1
SSDEEP 98304:CgRauSBBA/DjlXJ9DQuZGRoYL6MXBLMVU6di87Tv4DLaexFI:/s9GJ9cuZGJBLMNdD4HaeI
TLSH
T1720633E01AC1AD4DD3F5A1381733FE2E4B64D023BB544686A95433D5FA2E6D2353E0B6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

12604345

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

6.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

392KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

Virtual Size

768KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp1

Size

3.8MB

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

8KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

2e8467e7a43f7081a31ce9016e9c6230b5b5f314850a205179b8d437b4c79cba

winmm

ws2_32

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

wldap32

comdlg32

generic

Sharing

General

Malware Config

Signatures

File Explorer

2e8467e7a43f7081a31ce9016e9c6230b5b5f314850a205179b8d437b4c79cba

winmm

ws2_32

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

wldap32

comdlg32

generic