a14848d5d7118fc5e265d956ac857703bb433b5b9b5029ae9ec38ab10d3b9e3c

Sharing

Copy URL

Twitter E-mail

General

Target

a14848d5d7118fc5e265d956ac857703bb433b5b9b5029ae9ec38ab10d3b9e3c
Size

2.1MB
MD5

6b8f922e24b6953f1646942d1fbb5493
SHA1

863747f5c00f71635ba9bc7ca7ed158e98852c6f
SHA256

a14848d5d7118fc5e265d956ac857703bb433b5b9b5029ae9ec38ab10d3b9e3c
SHA512

8e6991fce2939e1745d1d1dec8a0ef793706c22c4135c388a0662fd4f4355afa00ecd590b83e51a50ef295cf2536a9a3d060868de13496971e42ec33929c3028
SSDEEP

49152:Zl8V/HfDl3v33vqkWo2+rZra+hciZvCOhRv:ZqZ/ZfnvZWo/5hciZvCO7v

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs
Detects executables packed with VMProtect commercial packer.
vmprotect

Processes:

resource yara_rule

sample vmprotect

resource	yara_rule
sample	vmprotect

Files

a14848d5d7118fc5e265d956ac857703bb433b5b9b5029ae9ec38ab10d3b9e3c
.dll windows x86

7007e857b2082b449c5b5d1008496c03

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapReAlloc
HeapFree
IsBadReadPtr
GetTickCount
CloseHandle
WaitForSingleObject
CreateProcessA
GetStartupInfoA
WriteFile
GetVersionExA
Sleep
GetPrivateProfileStringA
ReadFile
GetFileSize
WritePrivateProfileStringA
GetLocalTime
GetCommandLineA
GlobalFree
FreeLibrary
HeapAlloc
LoadLibraryA
LCMapStringA
lstrcpyA
lstrlenA
PostQueuedCompletionStatus
CreateIoCompletionPort
GetLastError
GetSystemInfo
GetQueuedCompletionStatus
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateThread
GlobalSize
lstrcpyn
GlobalUnlock
GlobalLock
ExitProcess
GetModuleHandleA
GetProcessHeap
VirtualProtect
Module32First
Process32Next
Process32First
CreateToolhelp32Snapshot
GetProcAddress
MultiByteToWideChar
GlobalAlloc
RtlMoveMemory
DeviceIoControl
CreateFileA
GetModuleFileNameA
OpenProcess
lstrcatA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

MessageBoxTimeoutA
wvsprintfA
MessageBoxA
wsprintfA
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
ReleaseDC
GetDC
GetWindowRect
GetDesktopWindow

gdi32

CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
StretchBlt
GetObjectA
GetDIBits
DeleteDC
DeleteObject

advapi32

CryptHashData
CryptAcquireContextA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
CryptCreateHash

ws2_32

closesocket
gethostbyname
inet_ntoa
WSAStartup
recv
connect
WSASend
WSARecv
setsockopt
WSAIoctl
WSASocketA
inet_addr
htons
WSACleanup
WSAGetLastError
getpeername
listen
bind
send

ole32

CreateStreamOnHGlobal
CLSIDFromString
GetHGlobalFromStream

gdiplus

GdiplusStartup
GdipDisposeImage
GdipSaveImageToStream
GdipCreateBitmapFromStream

psapi

GetModuleFileNameExA

shlwapi

StrToIntExA
PathMatchSpecA
PathFindExtensionA
PathFileExistsA

msvcrt

_beginthreadex
floor
strncmp
realloc
memmove
strncpy
modf
strchr
strrchr
rand
_ftol
srand
sprintf
__CxxFrameHandler
??3@YAXPAX@Z
free
malloc
_CIfmod
??2@YAPAXI@Z
atoi

Exports

Exports

DCIBeginAccess
DCICloseProvider
DCICreateOffscreen
DCICreateOverlay
DCICreatePrimary
DCIDestroy
DCIDraw
DCIEndAccess
DCIEnum
DCIOpenProvider
DCISetClipList
DCISetDestination
DCISetSrcDestClip
GetDCRegionData
GetGameData
GetWindowRegionData
Init
WinWatchClose
WinWatchDidStatusChange
WinWatchGetClipList
WinWatchNotify
WinWatchOpen

Sections

.text
Size: - Virtual size: 107KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 240B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 724B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7007e857b2082b449c5b5d1008496c03

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ws2_32

ole32

gdiplus

psapi

shlwapi

msvcrt

Exports

Exports

Sections

.text Size: - Virtual size: 107KB

.rdata Size: - Virtual size: 4KB

.data Size: - Virtual size: 1.9MB

.vmp0 Size: - Virtual size: 52KB

.vmp1 Size: 2.1MB - Virtual size: 2.1MB

.reloc Size: 4KB - Virtual size: 240B

.rsrc Size: 4KB - Virtual size: 724B

.text
Size: - Virtual size: 107KB

.rdata
Size: - Virtual size: 4KB

.data
Size: - Virtual size: 1.9MB

.vmp0
Size: - Virtual size: 52KB

.vmp1
Size: 2.1MB - Virtual size: 2.1MB

.reloc
Size: 4KB - Virtual size: 240B

.rsrc
Size: 4KB - Virtual size: 724B