antivm_test[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
antivm_test.exe
Size 280KB
Sample261102-v5g9labx71
SHA256 8c20d4b8c6753ec8cc151c4a830f9aa93f430d4566b8b796742b196f7c4774a3
MD5 17db7e36f8fa67ed68a91dd216933353
SHA1 d086c46acbc8623a0b39d7caab3b5950f2729795
SHA512 b72dc6c211f7f85d4fb0c926b390f1613915f61ede84350caace2011199365e98ba41db932b6236d6608adbf9ef8a9ad339a7eb63ec2a47030ef69c32e7963b0
SSDEEP 6144:XYa1Wi7xPDYcIGs9o6dlNm1g5x0OUUbBWEggggMgggKj55xxxxxxT7:Ia1dfs9o6dF5x1BW57
TLSH
T18B542A1BB39324FCC657C1388AD79B72B532B8190338AE2F1AD4C7712E61D544E6EE64
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
antivm_test.exe

File Explorer

antivm_test.exe

.exe 280KB

antivm_test.exe

IMPHASH 1666935a1558e0a26a7e89b814e24d88
SHA256 8c20d4b8c6753ec8cc151c4a830f9aa93f430d4566b8b796742b196f7c4774a3
MD5 17db7e36f8fa67ed68a91dd216933353
SHA1 d086c46acbc8623a0b39d7caab3b5950f2729795
SHA512 b72dc6c211f7f85d4fb0c926b390f1613915f61ede84350caace2011199365e98ba41db932b6236d6608adbf9ef8a9ad339a7eb63ec2a47030ef69c32e7963b0
SSDEEP 6144:XYa1Wi7xPDYcIGs9o6dlNm1g5x0OUUbBWEggggMgggKj55xxxxxxT7:Ia1dfs9o6dF5x1BW57
TLSH
T18B542A1BB39324FCC657C1388AD79B72B532B8190338AE2F1AD4C7712E61D544E6EE64
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

GetUserNameA RegCloseKey RegEnumValueW RegOpenKeyExW RegQueryValueExW

iphlpapi

GetAdaptersInfo GetIpForwardTable

kernel32

CheckRemoteDebuggerPresent CloseHandle CreateEventA CreateSemaphoreA CreateToolhelp32Snapshot DeleteCriticalSection DuplicateHandle EnterCriticalSection FormatMessageA GetCPInfo GetComputerNameA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExW GetEnvironmentVariableW GetFileAttributesW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessAffinityMask GetSystemDirectoryW GetSystemTimeAsFileTime GetThreadContext GetThreadPriority GetTickCount GetTickCount64 GlobalMemoryStatusEx InitializeCriticalSection IsDebuggerPresent IsProcessorFeaturePresent LeaveCriticalSection LoadLibraryW LocalFree MultiByteToWideChar OpenProcess OutputDebugStringA Process32FirstW Process32NextW QueryDosDeviceA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEvent SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte

msvcrt

__C_specific_handler ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _assert _beginthreadex _cexit _commode _endthreadex _errno _fileno _fmode _initterm _lock _read _setjmp _setmode _strdup _unlock _vscprintf _vsnprintf _write abort atexit calloc exit fflush fprintf fputc fputs free fwrite getenv isxdigit localeconv longjmp malloc memchr memcmp memcpy memmove memset realloc setvbuf signal strchr strcmp strerror strlen strncmp strrchr strtoul system tolower vfprintf wcslen wcsrchr

user32

EnumDisplayDevicesW

Name

.text

Size

215KB

Virtual Size

215KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

944B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

antivm_test.exe

advapi32

iphlpapi

kernel32

msvcrt

user32

generic