Overview

overview

7

Static

static

7

EFfI.exe

windows7-x64

7

EFfI.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    EFfI.exe

  • Size

    2.8MB

  • Sample

    240630-scv9mszbre

  • MD5

    05529268a2eb991158ed884bd7a76b7f

  • SHA1

    16320aac38b85c5decaa1749e074dc81fc77e270

  • SHA256

    5443154f35416456b568138d9a687c4aeb39acc5055e4ac0c1b1644f68547972

  • SHA512

    d533eecf50514a30135e023ce18749addf62dcb0a84a6606ae479a403ef515b75010871ef76d44de58d84b62c97a98a2d0c0bbd272c4784fb8d42753ec66b5c9

  • SSDEEP

    49152:i4QYv863cveVpl2Ndss8x8FihEE92oiSfy0txKc6d33opNVRcRkQnnNO/i:4TxvedWdt89GEo+y0txKc6ypqR/nnU/i

Score
7/10
vmprotect

Malware Config

Targets

    • Target

      EFfI.exe

    • Size

      2.8MB

    • MD5

      05529268a2eb991158ed884bd7a76b7f

    • SHA1

      16320aac38b85c5decaa1749e074dc81fc77e270

    • SHA256

      5443154f35416456b568138d9a687c4aeb39acc5055e4ac0c1b1644f68547972

    • SHA512

      d533eecf50514a30135e023ce18749addf62dcb0a84a6606ae479a403ef515b75010871ef76d44de58d84b62c97a98a2d0c0bbd272c4784fb8d42753ec66b5c9

    • SSDEEP

      49152:i4QYv863cveVpl2Ndss8x8FihEE92oiSfy0txKc6d33opNVRcRkQnnNO/i:4TxvedWdt89GEo+y0txKc6ypqR/nnU/i

    Score
    7/10
    vmprotect

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks