835f4073f866c43bd18b7d8e64242ea5fd6039bfeed6e92edfdab4ada2dd059a

General

Target
835f4073f866c43bd18b7d8e64242ea5fd6039bfeed6e92edfdab4ada2dd059a
Size 2.7MB
Sample260817-maewzsyshx
SHA256 835f4073f866c43bd18b7d8e64242ea5fd6039bfeed6e92edfdab4ada2dd059a
MD5 6e03537731d4d2fd06ec3395081c1659
SHA1 bd8c129b90b83aec3c04a6fb18a683812d765edc
SHA512 f0579db5946428858b2d4bbfae0ae8e9fc76a0273214cb1887ae4e3aa07fba14fbb5c4e0894df92045bff787f4e1692d69e8d5b20d501fbe89b36fdd982c97b9
SSDEEP 49152:yEfOEe0P10bcxJj4dICoHjKBha67jBjK7D4Mazn5llgTFSLYPwikj1:yEfmFiHca6kvWnqZPtkj1
TLSH
T123D5333B8B15B1A4F55A0E306AF7102DD3616C000511EE7FD23E4ABA3CDE91539EAA77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
835f4073f866c43bd18b7d8e64242ea5fd6039bfeed6e92edfdab4ada2dd059a

File Explorer

835f4073f866c43bd18b7d8e64242ea5fd6039bfeed6e92edfdab4ada2dd059a

.exe 2.7MB

835f4073f866c43bd18b7d8e64242ea5fd6039bfeed6e92edfdab4ada2dd059a

IMPHASH d719295f79b1c6371335449711520360
SHA256 835f4073f866c43bd18b7d8e64242ea5fd6039bfeed6e92edfdab4ada2dd059a
MD5 6e03537731d4d2fd06ec3395081c1659
SHA1 bd8c129b90b83aec3c04a6fb18a683812d765edc
SHA512 f0579db5946428858b2d4bbfae0ae8e9fc76a0273214cb1887ae4e3aa07fba14fbb5c4e0894df92045bff787f4e1692d69e8d5b20d501fbe89b36fdd982c97b9
SSDEEP 49152:yEfOEe0P10bcxJj4dICoHjKBha67jBjK7D4Mazn5llgTFSLYPwikj1:yEfmFiHca6kvWnqZPtkj1
TLSH
T123D5333B8B15B1A4F55A0E306AF7102DD3616C000511EE7FD23E4ABA3CDE91539EAA77
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

6393709

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

259KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

Virtual Size

891KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp1

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

835f4073f866c43bd18b7d8e64242ea5fd6039bfeed6e92edfdab4ada2dd059a

kernel32

user32

gdi32

winmm

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

ws2_32

comdlg32

generic

Sharing

General

Malware Config

Signatures

File Explorer

835f4073f866c43bd18b7d8e64242ea5fd6039bfeed6e92edfdab4ada2dd059a

kernel32

user32

gdi32

winmm

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

ws2_32

comdlg32

generic