cusotm ldr.rar
- SHA256 2504b261329201848ce1a2fdc76f39f8f68df4d8458b905c9f08c2eaa2fecec1
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cusotm ldr.rar
Resource
win11-20260911-en
windows11-21h2-x64
14 signatures
150 seconds
General
- Target cusotm ldr.rar
- Size 6.0MB
- Sample261003-mba97axt4m
- SHA256 2504b261329201848ce1a2fdc76f39f8f68df4d8458b905c9f08c2eaa2fecec1
- MD5 0c33063703318247a1016aa7d31ebdbd
- SHA1 77c83aab19d404a26e8d1730241960c315cfed5a
- SHA512 add041261ecf1168d20a372c9551e6276e0cfe6717cbb8e9a5b9f458729cd646cf6e6c435b98f3750991c158374524bef575e59b9e309611b74a7ec1f2539ac1
- SSDEEP 98304:IDh69ekI+pqf07vqsfaG1KfgTB6nFm7r5oXl6hLE39VdLJ1s9ZEgz41:3I+B7vtf31KfgTknF8rC8hLKB9iZP41
- TLSH T19B5633B80C165865DB82E2E2765F933BC1319CF669D8FCC1F3A5BC433238751A2A5D92
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/VMProtectSDK64.dll unpack001/g48hfg234h8902f10hj.exe
File Explorer
-
cusotm ldr.rar.rar 6.0MB
-
VMProtectSDK64.dll.dll 116KB
-
g48hfg234h8902f10hj.exe.exe 8.1MB
VMProtectSDK64.dll
- IMPHASH 1851ff453adce0cef5274e320d5bed3c
- SHA256 af82c309ace1ce81c23aa190c65f4eaa4e2e668e227175e66b0637b56f546796
- MD5 724d8234d574846b6ee2262a2977650d
- SHA1 b3fb659ddb3306e23342a0232b9b85e924ae36d5
- SHA512 3ea5ed4fb38986098d19221e5dbf4f48a0ccf5c912235bfdc160bb949721c298e904bbaa1070beb67cb9cfdabb0163a7a51e593f37e2bc03c69b7200c3967e83
- SSDEEP 3072:xmcqYHq7Aiytzg2ScpvgJcG5sqYX6UmHRlBS:80Hq7AiyegZgJZSX+xH
- TLSH T1F6C36C57B3E540BBE1B6C679C8634A55D3B678150B24DBAF07A402162F233D18E3AF72
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
8864
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
IsDebuggerPresent
GetLocalTime
GetTickCount
GetModuleFileNameW
GetPrivateProfileStringW
MultiByteToWideChar
WideCharToMultiByte
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
InterlockedFlushSList
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
HeapFree
HeapAlloc
GetStringTypeW
GetACP
GetStdHandle
GetFileType
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetStdHandle
HeapSize
HeapReAlloc
GetConsoleMode
FlushFileBuffers
WriteFile
GetConsoleCP
SetFilePointerEx
CloseHandle
WriteConsoleW
CreateFileW
RaiseException
VMProtectActivateLicense
VMProtectBegin
VMProtectBeginMutation
VMProtectBeginUltra
VMProtectBeginUltraLockByKey
VMProtectBeginVirtualization
VMProtectBeginVirtualizationLockByKey
VMProtectDeactivateLicense
VMProtectDecryptStringA
VMProtectDecryptStringW
VMProtectEnd
VMProtectFreeString
VMProtectGetCurrentHWID
VMProtectGetOfflineActivationString
VMProtectGetOfflineDeactivationString
VMProtectGetSerialNumberData
VMProtectGetSerialNumberState
VMProtectIsDebuggerPresent
VMProtectIsProtected
VMProtectIsValidImageCRC
VMProtectIsVirtualMachinePresent
VMProtectSetSerialNumber
Name
.text
Size
67KB
Virtual Size
66KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
39KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
512B
Virtual Size
148B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=241, version=40116,
count=124, id=243, version=40116,
count=14, id=242, version=40116,
count=7, id=259, version=24123,
count=20, id=261, version=24123,
count=17, id=260, version=24123,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=90, id=1, productName=Unmarked objects,
count=2, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
g48hfg234h8902f10hj.exe
- IMPHASH 503dfeab471ff51faed17ad10313c2d6
- SHA256 2c0eef370278b8569f8d79530d588642b91832d6f8ee546580da0f327b7ec192
- MD5 547b64c76a4a1aaf539e923f5c04cf63
- SHA1 cae651f873952e1d515fe7fe71a6b461d36d5c12
- SHA512 f8b4d9aea2c3f9980c7d7ce9da36784d2d4e644a187c489528358d76b94314b2fd4274c60e4567506794c0ad26a0acdb932e850d31731ac228fe323287e8dc26
- SSDEEP 196608:8HScCTOXGZ5aTrkU4N5RG4kF0/dkGZpMHF/3NDUiVGZ:8HuOXgaEZxG56dkIeF/9DUS
- TLSH T1F2861217F2A542ECC167C578C666970BE7B178191331AADF27D01AE2AF13AE05E7E340
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1120032
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
WriteFile
DeviceIoControl
TerminateProcess
CreateNamedPipeW
CreateFileW
FileTimeToSystemTime
LoadLibraryA
Beep
LocalFree
ExitProcess
SystemTimeToFileTime
GetConsoleWindow
GetSystemTime
SetConsoleTitleW
IsDebuggerPresent
ConnectNamedPipe
CheckRemoteDebuggerPresent
FlushFileBuffers
GetExitCodeProcess
VirtualProtect
SetLastError
CreateThread
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
GetLocaleInfoA
WriteConsoleW
HeapSize
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
FindNextFileW
FindFirstFileExW
FindClose
GetOEMCP
GetACP
IsValidCodePage
ReadConsoleW
GetTimeZoneInformation
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
GetCurrentProcessId
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
UnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
GetStdHandle
GetModuleFileNameW
IsProcessorFeaturePresent
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
RtlUnwind
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
RaiseException
RtlPcToFileHeader
RtlUnwindEx
RtlLookupFunctionEntry
CreateFileMappingA
GetLocalTime
CreateMutexA
GetComputerNameA
LoadLibraryExW
QueryPerformanceCounter
MapViewOfFile
VirtualFreeEx
CreateDirectoryA
CreateProcessA
GetTempFileNameW
OpenFileMappingA
CreateRemoteThread
FreeLibrary
GetModuleHandleW
GetFileSize
VirtualAllocEx
GetProcAddress
CloseHandle
Process32FirstW
DeleteFileA
QueryPerformanceFrequency
CreateFileA
K32GetModuleBaseNameW
Process32NextW
GetFileAttributesA
OpenMutexA
InitializeSListHead
GetSystemTimeAsFileTime
GetStartupInfoW
SetUnhandledExceptionFilter
GetProcessHeap
HeapFree
HeapReAlloc
HeapAlloc
GetFileSizeEx
GetStringTypeW
SetEndOfFile
GetCPInfo
CompareStringEx
DecodePointer
EncodePointer
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
LCMapStringEx
WakeAllConditionVariable
SleepConditionVariableSRW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetSystemTimePreciseAsFileTime
GetExitCodeThread
WaitForSingleObjectEx
GetCurrentThreadId
GetLastError
GetTickCount64
SetLocalTime
GetTempPathA
Sleep
CreateToolhelp32Snapshot
OpenProcess
K32EnumProcessModulesEx
GetModuleHandleA
UnmapViewOfFile
WaitForSingleObject
GetVolumeInformationA
GetEnvironmentVariableA
GetTempPathW
GetCurrentProcess
WriteProcessMemory
IsValidLocale
ReadFile
user32
UnregisterClassW
GetSystemMetrics
CreateWindowExW
DestroyWindow
GetWindowRect
DefWindowProcW
GetWindowThreadProcessId
GetAsyncKeyState
FindWindowA
ShowWindow
DispatchMessageW
PeekMessageW
SetLayeredWindowAttributes
TranslateMessage
FindWindowW
SetWindowsHookExW
PostThreadMessageW
PostQuitMessage
RegisterClassExW
GetWindowTextA
MoveWindow
SetClipboardData
GetClipboardData
EmptyClipboard
ScreenToClient
OpenClipboard
GetCursorPos
SetCursorPos
ReleaseCapture
IsWindowUnicode
GetClientRect
SetCursor
SetCapture
LoadCursorW
GetForegroundWindow
GetKeyboardLayout
TrackMouseEvent
GetMessageExtraInfo
GetKeyState
UpdateWindow
CloseClipboard
GetCapture
ClientToScreen
advapi32
OpenProcessToken
OpenServiceA
RegOpenKeyExA
CryptDestroyHash
CryptHashData
CryptDeriveKey
CryptCreateHash
OpenSCManagerA
CryptEncrypt
RegQueryValueExA
CloseServiceHandle
RegCloseKey
CryptAcquireContextA
CryptDestroyKey
CryptGetHashParam
QueryServiceStatus
LookupPrivilegeValueW
AdjustTokenPrivileges
CryptAcquireContextW
CryptReleaseContext
vmprotectsdk64
VMProtectBeginMutation
VMProtectBeginUltra
VMProtectEnd
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
winhttp
WinHttpSetOption
WinHttpQueryDataAvailable
WinHttpConnect
WinHttpSetTimeouts
WinHttpWriteData
WinHttpOpenRequest
WinHttpReadData
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpAddRequestHeaders
WinHttpOpen
WinHttpReceiveResponse
WinHttpSendRequest
bcrypt
BCryptDecrypt
BCryptImportKeyPair
BCryptSetProperty
BCryptGenerateSymmetricKey
BCryptFinalizeKeyPair
BCryptGetProperty
BCryptDestroyKey
BCryptEncrypt
BCryptCreateHash
BCryptGenerateKeyPair
BCryptHashData
BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptFinishHash
BCryptGenRandom
BCryptOpenAlgorithmProvider
BCryptExportKey
crypt32
CryptImportPublicKeyInfoEx2
CertStrToNameA
CertOpenSystemStoreA
CertEnumCertificatesInStore
CertCloseStore
CryptDecodeObjectEx
CertCreateSelfSignCertificate
CertFreeCertificateContext
CryptStringToBinaryA
CryptBinaryToStringA
d3d11
D3D11CreateDeviceAndSwapChain
dwmapi
DwmExtendFrameIntoClientArea
urlmon
URLDownloadToFileW
dbghelp
ImageDirectoryEntryToData
ws2_32
WSAGetLastError
htonl
WSAStartup
inet_pton
listen
closesocket
bind
accept
htons
setsockopt
socket
connect
recv
send
secur32
InitializeSecurityContextW
DecryptMessage
FreeCredentialsHandle
AcquireCredentialsHandleW
QueryContextAttributesW
DeleteSecurityContext
AcceptSecurityContext
EncryptMessage
FreeContextBuffer
imm32
ImmReleaseContext
ImmSetCandidateWindow
ImmGetContext
ImmSetCompositionWindow
d3dcompiler_43
D3DCompile
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
346KB
Virtual Size
346KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6.4MB
Virtual Size
6.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
55KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=185, id=261, version=33145,
count=29, id=260, version=33145,
count=20, id=259, version=33145,
count=1, id=253, version=35721,
count=12, id=259, version=35721,
count=18, id=260, version=35721,
count=26, id=260, version=31107,
count=6, id=156, version=21202,
count=96, id=261, version=35721,
count=2, id=257, productName=VS2015 UPD3.1 build 24215, version=24215,
count=29, id=257, version=33145,
count=328, id=1, productName=Unmarked objects,
count=19, id=265, version=36248,
count=1, id=255, version=36248,
count=1, id=258, version=36248,