bca8ae16819c5f5784bf9f228c4c5da25f967b2cfbe3b5a496dc9a5b5abae833

Sharing

Copy URL

Twitter E-mail

General

Target

bca8ae16819c5f5784bf9f228c4c5da25f967b2cfbe3b5a496dc9a5b5abae833
Size

763KB
MD5

6ed8b531b98175cf69ff0d5c9f5699ed
SHA1

146e3fab9c3c69a2bc0df53259447e63682306f0
SHA256

bca8ae16819c5f5784bf9f228c4c5da25f967b2cfbe3b5a496dc9a5b5abae833
SHA512

b73eccba855b1fec15857f91eeb8f397a0f087ad69039730e6574c8e318aaaf695f51b767eb6f9c3b06112d4ded47dfdf122709686c3062e1fb4c8c2d94d6853
SSDEEP

12288:AbrGo1pFwYkK19iOCr+TMoO30mYn0YaAsGhQ7VM5GxKTrH5vQ2Y1KZ85dyp8Ys8w:AbrGoqK19iOCr+TMoO30mYn0YaAst7V3

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

bca8ae16819c5f5784bf9f228c4c5da25f967b2cfbe3b5a496dc9a5b5abae833
.dll windows x86

d5d9b03040578c728744efe9ec93e06e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

inet_ntoa

wininet

InternetOpenW

shlwapi

StrCmpIW

imm32

ImmGetCompositionStringW

winmm

mixerSetControlDetails

psapi

GetModuleFileNameExW

userenv

CreateEnvironmentBlock

kernel32

GetModuleHandleA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess

user32

GetKeyNameTextW
MessageBoxA

gdi32

BitBlt

advapi32

CreateServiceW

shell32

SHChangeNotify

ole32

CoInitialize

oleaut32

SysFreeString

Exports

Exports

Install
Launch
ServiceMain
UnInstall

Sections

.text
Size: 459KB - Virtual size: 459KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rodata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 90KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 510KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp1
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp2
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d5d9b03040578c728744efe9ec93e06e

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

wininet

shlwapi

imm32

winmm

psapi

userenv

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 459KB - Virtual size: 459KB

.rodata Size: 11KB - Virtual size: 10KB

.rdata Size: 90KB - Virtual size: 89KB

.data Size: 25KB - Virtual size: 510KB

.vmp0 Size: 17KB - Virtual size: 16KB

.rsrc Size: 1KB - Virtual size: 4KB

.vmp1 Size: 78KB - Virtual size: 77KB

.vmp2 Size: 62KB - Virtual size: 62KB

.reloc Size: 17KB - Virtual size: 17KB

.text
Size: 459KB - Virtual size: 459KB

.rodata
Size: 11KB - Virtual size: 10KB

.rdata
Size: 90KB - Virtual size: 89KB

.data
Size: 25KB - Virtual size: 510KB

.vmp0
Size: 17KB - Virtual size: 16KB

.rsrc
Size: 1KB - Virtual size: 4KB

.vmp1
Size: 78KB - Virtual size: 77KB

.vmp2
Size: 62KB - Virtual size: 62KB

.reloc
Size: 17KB - Virtual size: 17KB