3b2accba7d02f6e640aa6d01b237b3cf1f2a0fbdea9e2bb5f79bac303fbfd762

Sharing

Copy URL

Twitter E-mail

General

Target

3b2accba7d02f6e640aa6d01b237b3cf1f2a0fbdea9e2bb5f79bac303fbfd762
Size

3.2MB
MD5

fd047c4d0d65de954156547902e998b4
SHA1

32cf1ce9c417cd07fdbd46677a8dca60eab8055a
SHA256

3b2accba7d02f6e640aa6d01b237b3cf1f2a0fbdea9e2bb5f79bac303fbfd762
SHA512

6fc0ba6797d6cfea80128b35c7fb38683e4c9250d0a4eac241c15272ffea325338e89d36e67d430b0adcafa7f9b77b2588bf08081de5709d9bfc865060ccd5d5
SSDEEP

49152:n09uXNej/JdlDHba9gGIzSDoup6/UWc5CQshce3VLmhE7atsTRDKelsVXqGHNyz4:Nkxi6GIzJ816lLvLTkjV6yUhjvIbyMX

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

3b2accba7d02f6e640aa6d01b237b3cf1f2a0fbdea9e2bb5f79bac303fbfd762
.exe windows x86

b6a933d9664127b47afe6193bd289b59

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetFileSize
DuplicateHandle
GetVolumeInformationA
GetFullPathNameA
FindNextFileA
InterlockedIncrement
GetModuleHandleW
TlsGetValue
GlobalReAlloc
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
SetErrorMode
WritePrivateProfileStringA
GetCurrentDirectoryA
GlobalFlags
GetCPInfo
GetOEMCP
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
HeapReAlloc
SetEnvironmentVariableA
SetCurrentDirectoryA
ExitProcess
GetCommandLineA
GetStartupInfoA
RtlUnwind
RaiseException
GetThreadLocale
VirtualQuery
SetStdHandle
GetFileType
HeapSize
GetACP
IsValidCodePage
LCMapStringA
LCMapStringW
HeapCreate
GetStringTypeA
WriteFile
GetStdHandle
SetHandleCount
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTimeZoneInformation
GetDriveTypeA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringW
LocalAlloc
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
lstrcmpW
GetModuleFileNameW
FreeResource
GlobalDeleteAtom
GetCurrentThread
GetCurrentThreadId
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
CompareStringA
InterlockedExchange
lstrcmpA
GetFileTime
GetFileSizeEx
GetFileAttributesA
FileTimeToLocalFileTime
FileTimeToSystemTime
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
LocalFree
MultiByteToWideChar
MulDiv
GetDiskFreeSpaceExA
CreateFileA
GetStringTypeW
ReadFile
lstrcpyA
InterlockedDecrement
Thread32Next
Thread32First
lstrlenA
VirtualFreeEx
GetExitCodeThread
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
HeapFree
GetProcessHeap
HeapAlloc
VirtualProtect
VirtualFree
VirtualAlloc
ResetEvent
SetEvent
CreateEventA
GetTickCount
OpenProcess
IsBadWritePtr
IsBadReadPtr
lstrcatW
GetSystemDirectoryW
GetModuleHandleA
GetLocalTime
GetVersionExA
FindClose
FindFirstFileA
ResumeThread
FormatMessageA
CreateThread
GetTempPathA
InitializeCriticalSection
Process32Next
UnmapViewOfFile
Process32First
CreateToolhelp32Snapshot
GetCurrentProcessId
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
CloseHandle
GetModuleFileNameA
MapViewOfFile
CreateFileMappingA
CreateDirectoryA
FreeLibrary
GetCurrentProcess
TerminateProcess
SetLastError
DeleteFileA
LoadLibraryA
GetLastError
CreateMutexA
Sleep
GetProcAddress
lstrcmpiA
FindResourceA
LoadResource
LockResource
SizeofResource
GetSystemInfo
WideCharToMultiByte
LoadLibraryA
GetProcAddress
GetLastError
FreeLibrary
InitializeCriticalSection
GetModuleFileNameW
GetModuleHandleW
TerminateProcess
GetCurrentProcess
DeleteCriticalSection
LoadLibraryW
CreateEventW
CompareStringW
SetLastError
GetModuleHandleA
VirtualProtect
GetTickCount
EnterCriticalSection
LeaveCriticalSection
VirtualFree
VirtualAlloc
WriteProcessMemory
CreateToolhelp32Snapshot
GetCurrentProcessId
GetCurrentThreadId
Thread32First
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
GetSystemInfo
LoadResource
MultiByteToWideChar
WideCharToMultiByte
FindResourceExW
FindResourceExA
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
HeapAlloc
HeapFree
HeapDestroy
HeapCreate
GetSystemTime
GetLocalTime
SystemTimeToFileTime
CompareFileTime
GetCommandLineA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
LCMapStringA
LCMapStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WriteFile
GetStdHandle
GetModuleFileNameA
RaiseException
Sleep
ExitProcess
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
HeapReAlloc
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
RtlUnwind
HeapSize
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
VirtualQuery
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

PostThreadMessageA
DestroyMenu
UnregisterClassA
MessageBeep
GetNextDlgGroupItem
InvalidateRgn
InvalidateRect
SetRect
IsRectEmpty
CopyAcceleratorTableA
ReleaseCapture
SetCapture
LoadCursorA
GetSysColorBrush
CharNextA
CharUpperA
SetCursor
GetMessageA
GetCursorPos
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
EnableMenuItem
CheckMenuItem
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
GetActiveWindow
CreateDialogIndirectParamA
GetNextDlgTabItem
EndDialog
MoveWindow
IsDialogMessageA
IsDlgButtonChecked
SetDlgItemTextA
RegisterWindowMessageA
SendDlgItemMessageA
WinHelpA
IsChild
GetCapture
SetWindowsHookExA
CallNextHookEx
GetClassLongA
SetPropA
GetFocus
SetFocus
GetWindowTextLengthA
GetDlgItem
GetTopWindow
DestroyWindow
GetMessagePos
MapWindowPoints
GetKeyState
SetMenu
UpdateWindow
GetClientRect
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
GetSysColor
AdjustWindowRectEx
ScreenToClient
EqualRect
CopyRect
PtInRect
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
GetMenu
RegisterClipboardFormatA
SetWindowTextA
SetWindowLongA
OffsetRect
wsprintfA
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetSystemMetrics
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
UnhookWindowsHookEx
SetWindowContextHelpId
GetParent
MapDialogRect
SetWindowPos
PostQuitMessage
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
ShowWindow
FindWindowA
GetClassNameA
IsWindow
PostMessageA
DispatchMessageA
TranslateMessage
PeekMessageA
GetWindowRect
LoadIconA
GetWindowTextA
EnumChildWindows
GetWindowThreadProcessId
MessageBoxA
IsWindowVisible
SetTimer
SendMessageA
EnableWindow
RemovePropA
GetForegroundWindow
EnumWindows
SetActiveWindow
SetForegroundWindow
IsIconic
GetPropA
GetDesktopWindow
GetWindow
GetMessageTime
MessageBoxW
CharUpperBuffW

gdi32

CreateRectRgnIndirect
GetBkColor
GetTextColor
GetStockObject
CreateBitmap
GetMapMode
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
DeleteDC
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
GetRgnBox
GetDeviceCaps
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetWindowExtEx
GetViewportExtEx
DeleteObject
SetMapMode
RestoreDC
SaveDC
GetObjectA
SetBkColor
SetTextColor
GetClipBox
SetViewportExtEx

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter
OpenPrinterA
DocumentPropertiesA

advapi32

RegSetValueExA
RegCreateKeyExA
RegQueryValueA
RegOpenKeyA
RegEnumKeyA
RegDeleteKeyA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA

shlwapi

PathFindFileNameA
UrlUnescapeA
PathStripToRootA
PathIsUNCA
PathFindExtensionA
PathRemoveFileSpecW

oledlg

ord8

ole32

CoTaskMemAlloc
CLSIDFromProgID
CLSIDFromString
CoInitializeEx
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleUninitialize
CoSetProxyBlanket
CoTaskMemFree
CoInitializeSecurity
CoUninitialize
CoInitialize
CoCreateInstance
CoRegisterMessageFilter
CoFreeUnusedLibraries
OleInitialize
CoRevokeClassObject
OleIsCurrentClipboard
OleFlushClipboard

oleaut32

SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroy
VariantCopy
SysAllocString
SysFreeString
VariantInit
VariantClear
SysStringLen
SysAllocStringByteLen
SysAllocStringLen
VariantChangeType
OleCreateFontIndirect

iphlpapi

GetAdaptersInfo

ws2_32

recv
send
bind
listen
accept
select
ioctlsocket
sendto
recvfrom
closesocket
gethostbyname
socket
getsockname
getpeername
ntohs
inet_ntoa
setsockopt
WSAGetLastError
WSAStartup
WSACleanup
htonl
htons
connect
inet_addr
ntohl

wininet

InternetOpenUrlA
InternetReadFile
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallback
InternetOpenA
InternetGetLastResponseInfoA
InternetCloseHandle
FindFirstUrlCacheEntryA
InternetQueryDataAvailable
InternetQueryOptionA
InternetCanonicalizeUrlA
InternetCrackUrlA
FindNextUrlCacheEntryA
DeleteUrlCacheEntry

ntdll

sscanf
_strcmpi
ZwQueryVirtualMemory
log
memchr
_allshr

Exports

Exports

AntiLDRSetModuleInfo

Sections

.text
Size: - Virtual size: 360KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 144B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 161KB - Virtual size: 172KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b6a933d9664127b47afe6193bd289b59

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shlwapi

oledlg

ole32

oleaut32

iphlpapi

ws2_32

wininet

ntdll

Exports

Exports

Sections

.text Size: - Virtual size: 360KB

.rdata Size: - Virtual size: 76KB

.data Size: - Virtual size: 32KB

.vmp0 Size: - Virtual size: 2.6MB

.vmp1 Size: 3.1MB - Virtual size: 3.1MB

.reloc Size: 144B - Virtual size: 4KB

.rsrc Size: 161KB - Virtual size: 172KB

.text
Size: - Virtual size: 360KB

.rdata
Size: - Virtual size: 76KB

.data
Size: - Virtual size: 32KB

.vmp0
Size: - Virtual size: 2.6MB

.vmp1
Size: 3.1MB - Virtual size: 3.1MB

.reloc
Size: 144B - Virtual size: 4KB

.rsrc
Size: 161KB - Virtual size: 172KB