63cec4915acd1193f1634e21ca928ea6199a47f62167ed021160ff060326c73a

Sharing

Copy URL Twitter E-mail

General

Target
63cec4915acd1193f1634e21ca928ea6199a47f62167ed021160ff060326c73a
Size 5.3MB
Sample260808-mbgrzayvb1
SHA256 63cec4915acd1193f1634e21ca928ea6199a47f62167ed021160ff060326c73a
MD5 8281efdf9a9652a490bbed6b7a28030e
SHA1 b259669ce76b19f147eb7a247bcb9d9bb1018146
SHA512 7710bad95b5f26b14e97996ee94cd45202b2549efc6077a6e78de3eb1ba68d185d315ba6c43537a79a0d38eec1cc80efbb5f2b5f007658ae1eee47f64809a880
SSDEEP 98304:sRfvdqxq6TsBTMUWvKfgFsauVHMvA4somOST0LBoNyzsDceHUx77cpXn4sbjuX0k:OgxpY+egmaUH+sovPlYBwaUx77cysnhk
TLSH
T1B14622BE614C3328C45A84741137EC46B1F61B1E1BEDD5AAB2DBFAC077AE811DA05F06
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
63cec4915acd1193f1634e21ca928ea6199a47f62167ed021160ff060326c73a

File Explorer

63cec4915acd1193f1634e21ca928ea6199a47f62167ed021160ff060326c73a

.exe 5.3MB

63cec4915acd1193f1634e21ca928ea6199a47f62167ed021160ff060326c73a

IMPHASH 991937997e0f80d632d78608d04ad716
SHA256 63cec4915acd1193f1634e21ca928ea6199a47f62167ed021160ff060326c73a
MD5 8281efdf9a9652a490bbed6b7a28030e
SHA1 b259669ce76b19f147eb7a247bcb9d9bb1018146
SHA512 7710bad95b5f26b14e97996ee94cd45202b2549efc6077a6e78de3eb1ba68d185d315ba6c43537a79a0d38eec1cc80efbb5f2b5f007658ae1eee47f64809a880
SSDEEP 98304:sRfvdqxq6TsBTMUWvKfgFsauVHMvA4somOST0LBoNyzsDceHUx77cpXn4sbjuX0k:OgxpY+egmaUH+sovPlYBwaUx77cysnhk
TLSH
T1B14622BE614C3328C45A84741137EC46B1F61B1E1BEDD5AAB2DBFAC077AE811DA05F06
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7477017

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

Virtual Size

161KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vmp0

Size

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

5.3MB

Virtual Size

5.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

208B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

469B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

63cec4915acd1193f1634e21ca928ea6199a47f62167ed021160ff060326c73a

kernel32

shell32

msvcp140

winhttp

wininet

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

wtsapi32

user32

generic