popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

DimenSaint.exe

VMProtect Malicious Library PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Nov. 1, 2021, 10:25 a.m. Nov. 1, 2021, 10:29 a.m.
Size 5.5MB
Type PE32 executable (console) Intel 80386, for MS Windows
MD5 d1467f50022d8c25d69d80fceb9d2f32
SHA256 578712ce5c4301ae924ae943567a192f352376f2c03edf348d362a3dcf23949c
CRC32 1E0F7C8A
ssdeep 98304:/itG8zJTB7V/+4FkXwStCejqIS9VONPKHvY6hlKCfGRAUW8Jr0A6SVUtT/+VBgjO:/+GIB7V/rFkXwACwqj9Vaig6rKwGRfWT
Yara
  • VMProtect_Zero - VMProtect packed file
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .vmp0
section .vmp1
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2504
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002a0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
name RT_VERSION language LANG_CHINESE filetype PGP symmetric key encrypted data - Plaintext or unencrypted data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x008ef0a0 size 0x0000018c
section {u'size_of_data': u'0x00576200', u'virtual_address': u'0x00377000', u'entropy': 7.957600767789245, u'name': u'.vmp1', u'virtual_size': u'0x005760e0'} entropy 7.95760076779 description A section with a high entropy has been found
entropy 0.999553172475 description Overall entropy of this PE file is high
section .vmp0 description Section name indicates VMProtect
section .vmp1 description Section name indicates VMProtect
Bkav W32.AIDetect.malware2
Lionic Trojan.Win32.Malicious.4!c
Elastic malicious (high confidence)
Cynet Malicious (score: 100)
McAfee Artemis!D1467F50022D
Cylance Unsafe
Sangfor Suspicious.Win32.Save.a
K7AntiVirus Trojan ( 7000001c1 )
BitDefender Trojan.GenericKD.37821661
K7GW Trojan ( 7000001c1 )
Cybereason malicious.0022d8
BitDefenderTheta Gen:NN.ZexaF.34236.@F0@a8dQmwgj
Cyren W32/Agent.DIQ.gen!Eldorado
Symantec ML.Attribute.HighConfidence
APEX Malicious
Paloalto generic.ml
ClamAV Win.Malware.Vmprotbad-9855134-0
Alibaba Trojan:Win32/VMProtBad.c9efedc4
MicroWorld-eScan Trojan.GenericKD.37821661
Rising Malware.Heuristic!ET#93% (RDMK:cmRtazq+/jxfnxvq10YHpPBbmVCb)
Ad-Aware Trojan.GenericKD.37821661
Emsisoft Trojan.GenericKD.37821661 (B)
Comodo Malware@#1qignphq7o0u2
TrendMicro TROJ_GEN.R002C0RJM21
McAfee-GW-Edition BehavesLike.Win32.Generic.tc
FireEye Generic.mg.d1467f50022d8c25
Sophos Mal/VMProtBad-A
Ikarus Trojan.Win32.VMProtBad
MAX malware (ai score=84)
Microsoft Trojan:Win32/Tnega!ml
Arcabit Trojan.Generic.D2411CDD
AhnLab-V3 Malware/Win.Generic.C4409700
Malwarebytes Trojan.MalPack.VMP
TrendMicro-HouseCall TROJ_GEN.R002C0RJM21
SentinelOne Static AI - Malicious PE
eGambit Unsafe.AI_Score_79%
Fortinet W32/Agent.ADER!tr
Webroot W32.Malware.Gen
AVG Win32:Malware-gen
Avast Win32:Malware-gen
CrowdStrike win/malicious_confidence_100% (W)