e141d6335d536c66f60bd427f92316976b95128077448ad085328f71902e3094

Sharing

Copy URL Twitter E-mail

General

Target

e141d6335d536c66f60bd427f92316976b95128077448ad085328f71902e3094
Size

61KB
MD5

63f27c647a89c700e493b78b869a90d8
SHA1

aebcf691e85c367916f3ecab51fddef27d38392d
SHA256

e141d6335d536c66f60bd427f92316976b95128077448ad085328f71902e3094
SHA512

bf76eee1d10a4423b16809aae1b4aede0dd82b36fc39f81d716dbb265d0a7968237a62ececd76adbfe021a3c7ff8ec4a320ba8d9580bf90260fcf1f73573e5cf
SSDEEP

1536:nrvXFWY0cZivrVx547d7BfJdsQ1irJQFS75:nrscYvrVx54dmrUSd

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

e141d6335d536c66f60bd427f92316976b95128077448ad085328f71902e3094
.dll windows x86

819e7c17470ca10485d6744122c02222

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

memset

wininet

HttpOpenRequestW
HttpSendRequestW
InternetReadFile
InternetCloseHandle

kernel32

LeaveCriticalSection
GlobalAlloc
EnterCriticalSection
InitializeCriticalSection
CloseHandle
CreateThread
GlobalFree
OutputDebugStringW
GetTickCount
lstrlenW
TerminateProcess
WaitForSingleObject
WritePrivateProfileStringW
GetPrivateProfileIntW
SystemTimeToFileTime
GetLocalTime
lstrcatW
GetTempPathW
GetCurrentThreadId
CreateProcessW
GetStartupInfoW
Sleep
lstrcpyW
lstrcpynW
InterlockedExchange
GetProcAddress
LoadLibraryW
GetModuleHandleW
OpenProcess
Process32NextW
lstrcmpiW
Process32FirstW
CreateToolhelp32Snapshot
lstrlenA
OutputDebugStringA
WideCharToMultiByte
CreateRemoteThread
GetModuleHandleA
WriteProcessMemory
VirtualAllocEx
GetModuleFileNameA
LoadLibraryA
FreeLibraryAndExitThread
WriteFile
TerminateThread
ReadFile
GetLastError
ConnectNamedPipe
CreateNamedPipeW
lstrcmpW
GetModuleFileNameW

user32

GetClientRect
GetWindowLongW
wsprintfW
GetWindowThreadProcessId
EnumWindows
FindWindowExW
PostThreadMessageW
DispatchMessageW
TranslateMessage
GetMessageW
wsprintfA
EnumThreadWindows
GetWindowTextW

advapi32

CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
RegisterServiceCtrlHandlerW
SetServiceStatus

Exports

Exports

ServiceMain

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 612B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sect
Size: 1024B - Virtual size: 568B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

819e7c17470ca10485d6744122c02222

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

wininet

kernel32

user32

advapi32

Exports

Exports

Sections

.text Size: 13KB - Virtual size: 13KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: - Virtual size: 612B

Sect Size: 1024B - Virtual size: 568B

.vmp0 Size: 1KB - Virtual size: 1KB

.vmp1 Size: 39KB - Virtual size: 38KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 13KB - Virtual size: 13KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: - Virtual size: 612B

Sect
Size: 1024B - Virtual size: 568B

.vmp0
Size: 1KB - Virtual size: 1KB

.vmp1
Size: 39KB - Virtual size: 38KB

.reloc
Size: 2KB - Virtual size: 1KB