d3c48610ed8939d39f7b475b538ed6cb925a74a9255294fc0b3a9a1b4919e2a9

General

Target
d3c48610ed8939d39f7b475b538ed6cb925a74a9255294fc0b3a9a1b4919e2a9
Size 7.7MB
Sample260823-pfppgswfpd
SHA256 d3c48610ed8939d39f7b475b538ed6cb925a74a9255294fc0b3a9a1b4919e2a9
MD5 ef1036419f28388bee0ad352ced250dc
SHA1 ef732f520632c55f7677e60e7ea875e8f67de9ec
SHA512 35f07f0a981d0c568e3d235bbb2dfef86f7efdb66d131e5245cb555827dd0aea73ec0b83c15324f786959033de8307e1d92d4bbe5e821ad5caadfc6587f80d62
SSDEEP 196608:yo+0nOlgcQKkzpUmMHC/02hpQ6eAdsv14v0OZqsck/+E/y3:L+0nOicQlzpUmMH002jQ6sa0OZLck/+
TLSH
T10A8633B360A6055AD5E8C839C537FDA431F6033B8F82A8B859A9F9C129525F5F213F43
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d3c48610ed8939d39f7b475b538ed6cb925a74a9255294fc0b3a9a1b4919e2a9

File Explorer

d3c48610ed8939d39f7b475b538ed6cb925a74a9255294fc0b3a9a1b4919e2a9

.dll 7.7MB

d3c48610ed8939d39f7b475b538ed6cb925a74a9255294fc0b3a9a1b4919e2a9

IMPHASH 8706985a12f7f3450997570bd9b86dcc
SHA256 d3c48610ed8939d39f7b475b538ed6cb925a74a9255294fc0b3a9a1b4919e2a9
MD5 ef1036419f28388bee0ad352ced250dc
SHA1 ef732f520632c55f7677e60e7ea875e8f67de9ec
SHA512 35f07f0a981d0c568e3d235bbb2dfef86f7efdb66d131e5245cb555827dd0aea73ec0b83c15324f786959033de8307e1d92d4bbe5e821ad5caadfc6587f80d62
SSDEEP 196608:yo+0nOlgcQKkzpUmMHC/02hpQ6eAdsv14v0OZqsck/+E/y3:L+0nOicQlzpUmMH002jQ6sa0OZLck/+
TLSH
T10A8633B360A6055AD5E8C839C537FDA431F6033B8F82A8B859A9F9C129525F5F213F43
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

7771723

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Anti_SoFtware Breakpoint C34cjwlxWXOKWQLXKW24XWKOXWKfe24ckw0cwd34 CJW9982xwwCJ9C2jxwwc4FWCWXCXceeF3do2WBCLvFIMkwxKM6sd4brItlDuOH3RqYrNj CWXxl092xckCOWXAL02xcw4FFXAicscwdwxfwF CXK0239XX2XALXCWCrcF02C4CDCWxcwx CiNTW7zQ9XtN3o4oJef5sFs5bwKu Close_AppLicaTion DLL_Lnjection DLL_Unloading DXWDL7739xwDchw628DJI9WXU2XI29K2X2X2 Forc_quit_miniworld HWyFEoCiNTW7zQ9XtN3o4k272WBCLvFIMoDVxLN JED1C6O5JxsUS8csFPtkOjGZ7G6IZVjtqfDFwy08APWvmoIrQsSfKV M6sd4brItKWQLXKW24XWKOXWKfe24ckwl MoDVxLNxRqqg0XSSNcvYfAiNTW7zQ9XtN3o4k2 N3snzoJef25sFs5bwKul R14CZc6bHHcw22xCCXW334xqcwD2FSFfxvaf2519CdlwlqcwCQftggscs9CSCSC3MMNCZc6smxl2dwf24FW TcTplsnzoJef5sFsnbvKM6sd4brItlDuOH3RqYrNj WXAAWhiteWBC WXPWXOWOXOW8282x294xk20x2OXPW2S2XFEXQDVXX23 WY5eWXAAWhiteWBCLvFIMoDVxLNxRqqg0XSSNcvYfAP23Mkz XWXxf0c9wc23C20D9CSCSC3MMNCZco203xD cTcTplsnzoJef5sFs5bwKulGhe18I6vrQIOS0bqq d354cvcr24CKKwj9xwFowxlpDwiclq02CKwqmvzlwowiFZR dwswfw24w24xwwww23s323 e92XWKRekrea34CW24xnsmxl2dwf24FWfwQfhtiujfe eRQZWnp9LYCH62qKnbvKM6sd4brItlDuOH3RqYrNjqrcbc efSetGrhEZMVnf6bgeub29l9xc7MKRXKSIeeeH4z7gA3r4gQ327 erjkuFzIfn4zmuycF92CWcwfwgw25fwFWXWfgwd g6CC5PhFbB2t53V1wr2B2yQk4I5GEX1sOuGE36sVLRqxUjBTMHNR ghQvQP0u66GQbH0IVRGqRPmLudlGB2rePRtpQUK8jttuMKH h68UU7Bp3hoxuCpbnH3t0oCHp7w4UpZ2l0VcpIwKc hDPwv6pUHWp54GcnsCoAKhL4VmxwO5RubqGz3Fj5jCtcGLmyKIQDWeFB hMxOi6bHWyFEoCiNTW7zQ9XtN3o4k272yI5rEEtNwtDjCOchN null24cDWXWCwf3f345CWkcw20x2cafwF pjGFmJEpk7wdbjw1JK38oKqpG8TXu r5Dr35CW4cfcwcpxqe2F3FWXFAXXXXXWzfwfgFE r8T4YJOK4K4y9utKOwvq9ePmmyU4FLn50eH8nh1oYjORMBpmb4 sANMh4Zcy9cAOHYAqOuGE311GLwI9Leu0 shot teWBCLvFIMoDVxLNxRqqg0XSSNcvYfAiNTW7zQ9XtN3o4k272WBCLvFIM wFF82DXL8xwFFfFJCW972cfG wc23C20D9CSCSC3MMNCZc6bHWyFEoCiNTW7zQ9XtN3 wtDjCOchNP386dK677ml649eerRB2mCWpimn9x x294xk20x2OXPW2S2XFEXQN3o4k272hiteWBCLvFIM yFEoCiNTW7zQ9XtN3o4k272hiteWBCLvFIMoDVxLNxRqqg0XSSNcvY

Name

.text

Size

Virtual Size

768KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

975KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

345KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

Virtual Size

4.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

7.5MB

Virtual Size

7.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

160KB

Virtual Size

159KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

d3c48610ed8939d39f7b475b538ed6cb925a74a9255294fc0b3a9a1b4919e2a9

winmm

ws2_32

rasapi32

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

wininet

comdlg32

wtsapi32

generic

Sharing

General

Malware Config

Signatures

File Explorer

d3c48610ed8939d39f7b475b538ed6cb925a74a9255294fc0b3a9a1b4919e2a9

winmm

ws2_32

rasapi32

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

wininet

comdlg32

wtsapi32

generic