vmaware_test[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
vmaware_test.exe
Size 3.1MB
Sample260925-2f2ehayaph
SHA256 657ece2afa2e97b7ed85a04ba4097c22b9d58490b5dfbd6a98df656361710547
MD5 fba10d0ea6e78c8120eaf718aaf0b393
SHA1 2125c9355fefb61c5ce5fcd72aade4c326f3fb13
SHA512 661db3d4f67bc81258a94866d6e49d7d775b21943218de00f4638e9f9b1d95aefc54bac8df0649cec263529639a1935d017ce25e5dc87066c4e654b8477796f6
SSDEEP 49152:6RTpHhVqAVpsc0hy6NElM+o2TzHNvxYr8JvixX1aIf0yXqnG:YLp/iOM+hnJviHaIf0yXqnG
TLSH
T169E5E84369CB0DE5DED677B8A1D31335A734BD72CA291F2BAA04C2316D536C4AD2EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
vmaware_test.exe

File Explorer

vmaware_test.exe

.exe 3.1MB

vmaware_test.exe

IMPHASH fd90abd96988a6afe7d765758e1fd15a
SHA256 657ece2afa2e97b7ed85a04ba4097c22b9d58490b5dfbd6a98df656361710547
MD5 fba10d0ea6e78c8120eaf718aaf0b393
SHA1 2125c9355fefb61c5ce5fcd72aade4c326f3fb13
SHA512 661db3d4f67bc81258a94866d6e49d7d775b21943218de00f4638e9f9b1d95aefc54bac8df0649cec263529639a1935d017ce25e5dc87066c4e654b8477796f6
SSDEEP 49152:6RTpHhVqAVpsc0hy6NElM+o2TzHNvxYr8JvixX1aIf0yXqnG:YLp/iOM+hnJviHaIf0yXqnG
TLSH
T169E5E84369CB0DE5DED677B8A1D31335A734BD72CA291F2BAA04C2316D536C4AD2EB40
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AdjustTokenPrivileges GetTokenInformation LookupPrivilegeValueA OpenProcessToken RegGetValueW

gdi32

GetDeviceCaps

kernel32

AddVectoredExceptionHandler CloseHandle CreateEventA CreateSemaphoreA DeleteCriticalSection DuplicateHandle EnterCriticalSection EnumSystemFirmwareTables FileTimeToSystemTime FormatMessageA FreeLibrary GetActiveProcessorCount GetActiveProcessorGroupCount GetComputerNameA GetConsoleMode GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetLastError GetLogicalProcessorInformationEx GetModuleHandleA GetModuleHandleExA GetModuleHandleW GetPriorityClass GetProcAddress GetProcessAffinityMask GetProcessHeap GetProcessTimes GetStdHandle GetSystemFirmwareTable GetSystemTimeAdjustment GetSystemTimeAsFileTime GetSystemWow64DirectoryW GetThreadContext GetThreadGroupAffinity GetThreadPriority GetThreadTimes GetTickCount HeapAlloc HeapFree HeapReAlloc InitializeCriticalSection IsDebuggerPresent LeaveCriticalSection LoadLibraryExW LocalFree MulDiv OpenProcess OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetConsoleMode SetConsoleOutputCP SetEvent SetLastError SetPriorityClass SetProcessAffinityMask SetSystemTime SetThreadAffinityMask SetThreadContext SetThreadGroupAffinity SetThreadPriority SetThreadPriorityBoost SetUnhandledExceptionFilter Sleep SleepEx SuspendThread TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection VirtualLock VirtualProtect VirtualQuery VirtualUnlock WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte

api-ms-win-crt-convert-l1-1-0

mbrtowc mbsrtowcs strtoul wcrtomb

api-ms-win-crt-environment-l1-1-0

__p__environ getenv

api-ms-win-crt-filesystem-l1-1-0

_fstat64

api-ms-win-crt-heap-l1-1-0

_aligned_free _aligned_malloc _set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func _configthreadlocale localeconv setlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr _fdopen

api-ms-win-crt-private-l1-1-0

__C_specific_handler __intrinsic_setjmpex longjmp memchr memcmp memcpy memmove strchr strstr wcschr wcsstr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _assert _beginthreadex _cexit _configure_narrow_argv _crt_atexit _endthreadex _errno _exit _initialize_narrow_environment _set_app_type _initterm _initterm_e _register_thread_local_exe_atexit_callback _set_errno _set_invalid_parameter_handler abort exit signal strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vswprintf_s _fileno _fseeki64 _ftelli64 _get_osfhandle _lseeki64 _read _setmode _wfopen _write fclose fflush fopen fputc fputs fread fwrite getc getwc putc putwc setvbuf ungetc ungetwc

api-ms-win-crt-string-l1-1-0

_strdup _wcsnicmp iswctype memset strcmp strcoll strlen strncmp strnlen strpbrk strxfrm tolower towlower towupper wcscoll wcslen wcsnlen wcsxfrm wctype

api-ms-win-crt-time-l1-1-0

strftime wcsftime

api-ms-win-crt-utility-l1-1-0

rand_s

setupapi

SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiGetClassDevsW SetupDiGetDeviceInstanceIdW SetupDiGetDevicePropertyW SetupDiGetDeviceRegistryPropertyW

user32

GetDC ReleaseDC

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

109KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

51KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

73KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

152B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

176B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

1024B

Virtual Size

832B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

512B

Virtual Size

235B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/97

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

vmaware_test.exe

advapi32

gdi32

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

setupapi

user32

generic