45c7bbf4c5305f556c099f71c99b8c5219d978b7b6beac869ae2299d7c06ffea

Sharing

Copy URL Twitter E-mail

General

Target
45c7bbf4c5305f556c099f71c99b8c5219d978b7b6beac869ae2299d7c06ffea
Size 4.0MB
Sample260806-k2swtasshs
SHA256 623edac5d6342879a75238801651c4fff374a498a0262bd637c10f7b393618c7
MD5 f89e4cb3201882ab2bc0f5fc09b701b1
SHA1 f9991bbe69e56c66dd6a9c5829a88dcb7877a6e8
SHA512 23f6d84d1d9787639afd8109fa007d26ea1640653ec62d5cfa05818b5426d91b209489b0cc37930db27c3632d776e49b3a295f5325240b3c2494b0ae26d8b785
SSDEEP 49152:90oYxk6PDafrJBEqh5AQr0nx+YuEUL7qmAOqvHHd7p3Z2l4BzqoXYMunZcWm9oqF:3GX+w+rWQHtAJHJ9XXBuZ091eY6Je7Hl
TLSH
T12F16337339A05296E9F5C07BDA2BBE8833F5E27B4F84B07D51F64DC034449A192A34A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
45c7bbf4c5305f556c099f71c99b8c5219d978b7b6beac869ae2299d7c06ffea

File Explorer

45c7bbf4c5305f556c099f71c99b8c5219d978b7b6beac869ae2299d7c06ffea

.exe 4.0MB

45c7bbf4c5305f556c099f71c99b8c5219d978b7b6beac869ae2299d7c06ffea

SHA256 623edac5d6342879a75238801651c4fff374a498a0262bd637c10f7b393618c7
MD5 f89e4cb3201882ab2bc0f5fc09b701b1
SHA1 f9991bbe69e56c66dd6a9c5829a88dcb7877a6e8
SHA512 23f6d84d1d9787639afd8109fa007d26ea1640653ec62d5cfa05818b5426d91b209489b0cc37930db27c3632d776e49b3a295f5325240b3c2494b0ae26d8b785
SSDEEP 49152:90oYxk6PDafrJBEqh5AQr0nx+YuEUL7qmAOqvHHd7p3Z2l4BzqoXYMunZcWm9oqF:3GX+w+rWQHtAJHJ9XXBuZ091eY6Je7Hl
TLSH
T12F16337339A05296E9F5C07BDA2BBE8833F5E27B4F84B07D51F64DC034449A192A34A7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

685209711

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

_cJSONUtils_AddPatchToArray@16 _cJSONUtils_ApplyPatches@8 _cJSONUtils_ApplyPatchesCaseSensitive@8 _cJSONUtils_FindPointerFromObjectTo@8 _cJSONUtils_GenerateMergePatch@8 _cJSONUtils_GenerateMergePatchCaseSensitive@8 _cJSONUtils_GeneratePatches@8 _cJSONUtils_GeneratePatchesCaseSensitive@8 _cJSONUtils_GetPointer@8 _cJSONUtils_GetPointerCaseSensitive@8 _cJSONUtils_MergePatch@8 _cJSONUtils_MergePatchCaseSensitive@8 _cJSONUtils_SortObject@4 _cJSONUtils_SortObjectCaseSensitive@4 _cJSON_AddArrayToObject@8 _cJSON_AddBoolToObject@12 _cJSON_AddFalseToObject@8 _cJSON_AddItemReferenceToArray@8 _cJSON_AddItemReferenceToObject@12 _cJSON_AddItemToArray@8 _cJSON_AddItemToObject@12 _cJSON_AddItemToObjectCS@12 _cJSON_AddNullToObject@8 _cJSON_AddNumberToObject@16 _cJSON_AddObjectToObject@8 _cJSON_AddRawToObject@12 _cJSON_AddStringToObject@12 _cJSON_AddTrueToObject@8 _cJSON_Compare@12 _cJSON_CreateArray@0 _cJSON_CreateArrayReference@4 _cJSON_CreateBool@4 _cJSON_CreateDoubleArray@8 _cJSON_CreateFalse@0 _cJSON_CreateFloatArray@8 _cJSON_CreateIntArray@8 _cJSON_CreateNull@0 _cJSON_CreateNumber@8 _cJSON_CreateObject@0 _cJSON_CreateObjectReference@4 _cJSON_CreateRaw@4 _cJSON_CreateString@4 _cJSON_CreateStringArray@8 _cJSON_CreateStringReference@4 _cJSON_CreateTrue@0 _cJSON_Delete@4 _cJSON_DeleteItemFromArray@8 _cJSON_DeleteItemFromObject@8 _cJSON_DeleteItemFromObjectCaseSensitive@8 _cJSON_DetachItemFromArray@8 _cJSON_DetachItemFromObject@8 _cJSON_DetachItemFromObjectCaseSensitive@8 _cJSON_DetachItemViaPointer@8 _cJSON_Duplicate@8 _cJSON_GetArrayItem@8 _cJSON_GetArraySize@4 _cJSON_GetErrorPtr@0 _cJSON_GetNumberValue@4 _cJSON_GetObjectItem@8 _cJSON_GetObjectItemCaseSensitive@8 _cJSON_GetStringValue@4 _cJSON_HasObjectItem@8 _cJSON_InitHooks@4 _cJSON_InsertItemInArray@12 _cJSON_IsArray@4 _cJSON_IsBool@4 _cJSON_IsFalse@4 _cJSON_IsInvalid@4 _cJSON_IsNull@4 _cJSON_IsNumber@4 _cJSON_IsObject@4 _cJSON_IsRaw@4 _cJSON_IsString@4 _cJSON_IsTrue@4 _cJSON_Minify@4 _cJSON_Parse@4 _cJSON_ParseWithLength@8 _cJSON_ParseWithLengthOpts@16 _cJSON_ParseWithOpts@12 _cJSON_Print@4 _cJSON_PrintBuffered@12 _cJSON_PrintPreallocated@16 _cJSON_PrintUnformatted@4 _cJSON_ReplaceItemInArray@12 _cJSON_ReplaceItemInObject@12 _cJSON_ReplaceItemInObjectCaseSensitive@12 _cJSON_ReplaceItemViaPointer@12 _cJSON_SetNumberHelper@12 _cJSON_SetValuestring@8 _cJSON_Version@0 _cJSON_free@4 _cJSON_malloc@4

Name

.text

Size

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

270KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

642.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

7.2MB

Virtual Size

7.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

145KB

Virtual Size

145KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ