purge[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
purge.exe
Size 9.2MB
Sample260905-3cbkca1xex
SHA256 65d0b061555c90e557af6e287db2f6a12afd0d48a42c1ea88a3abf1e290c4c03
MD5 ef6d23e2e4fce34fa13318b50d893fe1
SHA1 7fb46359bfa74dc8b5cef9c87f3be61043b340cd
SHA512 c982b2dfa151379517dcacf9e28cb5f481892d9041cc33c9466ada84148712a23aa73d046d0812186c35684970054012dd7017b949f9ca3545a790a6b8ed3bfc
SSDEEP 196608:NTdkjlaZftHow7ZhFZbWcVOFgGFggnapmK3TSGoj3iER+C1QepWt:rc4cwlAXCGigaYKmvriER++QeM
TLSH
T166A623FF6044336CC41AC934A423FC85B2F1152E4BE999EAF5DB3BC46B5B4259A12F12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
purge.exe

File Explorer

purge.exe

.exe 9.2MB

purge.exe

IMPHASH 7b2658b4dbf0f37b82137582ac64d452
SHA256 65d0b061555c90e557af6e287db2f6a12afd0d48a42c1ea88a3abf1e290c4c03
MD5 ef6d23e2e4fce34fa13318b50d893fe1
SHA1 7fb46359bfa74dc8b5cef9c87f3be61043b340cd
SHA512 c982b2dfa151379517dcacf9e28cb5f481892d9041cc33c9466ada84148712a23aa73d046d0812186c35684970054012dd7017b949f9ca3545a790a6b8ed3bfc
SSDEEP 196608:NTdkjlaZftHow7ZhFZbWcVOFgGFggnapmK3TSGoj3iER+C1QepWt:rc4cwlAXCGigaYKmvriER++QeM
TLSH
T166A623FF6044336CC41AC934A423FC85B2F1152E4BE999EAF5DB3BC46B5B4259A12F12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

20484129

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

advapi32

RegGetValueW

iphlpapi

GetAdaptersAddresses

ole32

CoCreateFreeThreadedMarshaler

winhttp

WinHttpReceiveResponse

kernel32

GlobalLock FlsSetValue LocalAlloc LocalFree GetModuleFileNameW GetProcessAffinityMask SetProcessAffinityMask SetThreadAffinityMask Sleep ExitProcess FreeLibrary LoadLibraryA GetModuleHandleA GetProcAddress

user32

EmptyClipboard GetProcessWindowStation GetProcessWindowStation GetUserObjectInformationW

gdi32

DeleteObject

shell32

SHGetKnownFolderPath

msvcp140

?id@?$ctype@_W@std@@2V0locale@2@A

dwmapi

DwmGetColorizationColor

imm32

ImmGetContext

ntdll

ZwWriteVirtualMemory

version

GetFileVersionInfoSizeW

ws2_32

htons

crypt32

CertFreeCertificateContext

bcrypt

BCryptOpenAlgorithmProvider

vcruntime140

__intrinsic_setjmp

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

isspace

api-ms-win-crt-runtime-l1-1-0

_errno

api-ms-win-crt-math-l1-1-0

atan2f

api-ms-win-crt-stdio-l1-1-0

fseek

api-ms-win-crt-heap-l1-1-0

malloc

api-ms-win-crt-convert-l1-1-0

_ultow_s

api-ms-win-crt-filesystem-l1-1-0

_unlock_file

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-locale-l1-1-0

localeconv

api-ms-win-crt-environment-l1-1-0

_wgetenv

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

oleaut32

GetErrorInfo

wtsapi32

WTSSendMessageW

Name

.text

Size

Virtual Size

4.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vmp0

Size

Virtual Size

3.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

9.2MB

Virtual Size

9.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

196B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

770B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

purge.exe

d3d11

d3dcompiler_47

advapi32

iphlpapi

ole32

winhttp

kernel32

user32

gdi32

shell32

msvcp140

dwmapi

imm32

ntdll

version

ws2_32

crypt32

bcrypt

vcruntime140

vcruntime140_1

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

oleaut32

wtsapi32

generic