ba074cc13cf6636ae0578a7a6218c62b650ed129002ac41ce9cfde158a2bd012

Sharing

Copy URL

Twitter E-mail

General

Target

ba074cc13cf6636ae0578a7a6218c62b650ed129002ac41ce9cfde158a2bd012
Size

156KB
MD5

6af815643fd22b27a3d29edc1458dc00
SHA1

e34570b2b07e5e305be5553eb7d9c2b545a46532
SHA256

ba074cc13cf6636ae0578a7a6218c62b650ed129002ac41ce9cfde158a2bd012
SHA512

8144d623dd2263224de1d2fa580aa34c3ea1eae4b3daada0419bc4ced68a69e0d39279cb8dfb240e6bbe78ac464e1c81ddf3c6b19e869aef34a036ded9a3e8b2
SSDEEP

3072:owC0qvztzqbU3nCwwqDYbsky/mik/cwt5VS/hCN7HVLB6F5+fFy/Q:owCpv4mCmUbs3/VOcwt5VS/INDV9o5Uv

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

ba074cc13cf6636ae0578a7a6218c62b650ed129002ac41ce9cfde158a2bd012
.dll windows x86

a123be6c33d5cc41194f08b9d50f5ef8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentProcess
lstrcpyn
GetModuleHandleA
GetProcAddress
GetCurrentThread
Beep
VirtualQueryEx
VirtualProtect
LocalSize
IsBadWritePtr
RtlZeroMemory
IsBadReadPtr
UnmapViewOfFile
CreateFileMappingA
lstrlenW
MultiByteToWideChar
GetProcessHeap
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
GetModuleFileNameA
LCMapStringA
TerminateThread
DeleteFileA
MoveFileA
WriteFile
CreateFileA
GetTickCount
GetCommandLineA
FlushFileBuffers
SetStdHandle
SetFilePointer
GetStringTypeW
GetStringTypeA
GetOEMCP
Sleep
CreateMutexA
CreateThread
LoadLibraryA
OpenMutexA
CloseHandle
RtlMoveMemory
MapViewOfFile
GetLocalTime
OpenFileMappingA
GetACP
GetCPInfo
HeapSize
RaiseException
RtlUnwind
VirtualAlloc
LCMapStringW
VirtualFree
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetLastError
TlsGetValue
SetLastError
TlsFree
TlsAlloc
TlsSetValue
GetCurrentThreadId
TerminateProcess
InterlockedIncrement
InterlockedDecrement
GetVersion
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
VirtualProtect
GetModuleFileNameA
ExitProcess

user32

GetAsyncKeyState
GetInputState
GetForegroundWindow
ClientToScreen
GetClassNameA
GetClientRect
CallWindowProcA
PostMessageA
MessageBoxA
wsprintfA
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
MessageBeep
MessageBoxA

advapi32

CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA
CryptGetHashParam

gdiplus

GdipRotateWorldTransform
GdipSetPageUnit
GdipGetPageUnit
GdipSetPageScale
GdipGetPageScale
GdipGetDpiX
GdipGetDpiY
GdipTransformPoints
GdipTransformPointsI
GdipGetNearestColor
GdipDrawLine
GdipDrawLineI
GdipDrawLines
GdipDrawLinesI
GdipDrawArc
GdipDrawArcI
GdipDrawBezier
GdipDrawBezierI
GdipDrawBeziers
GdipDrawBeziersI
GdipDrawRectangle
GdipDrawRectangleI
GdipDrawRectangles
GdipDrawRectanglesI
GdipDrawEllipse
GdipDrawEllipseI
GdipDrawPie
GdipDrawPieI
GdipDrawPolygon
GdipDrawPolygonI
GdipDrawPath
GdipDrawCurve
GdipDrawCurveI
GdipDrawCurve2
GdipDrawCurve2I
GdipDrawCurve3
GdipDrawCurve3I
GdipDrawClosedCurve
GdipDrawClosedCurveI
GdipDrawClosedCurve2
GdipGetPenBrushFill
GdipGraphicsClear
GdipFillRectangle
GdipFillRectangleI
GdipFillRectangles
GdipFillRectanglesI
GdipFillPolygon
GdipFillPolygonI
GdipFillEllipse
GdipFillEllipseI
GdipFillPie
GdipFillPieI
GdipFillPath
GdipFillClosedCurve
GdipFillClosedCurve2
GdipFillClosedCurveI
GdipFillClosedCurve2I
GdipFillRegion
GdipDrawString
GdipMeasureString
GdipMeasureCharacterRanges
GdipDrawDriverString
GdipSetTextContrast
GdipGetTextContrast
GdipDrawImage
GdipDrawImageI
GdipDrawCachedBitmap
GdipDrawImageRectRect
GdipDrawImageRectRectI
GdipDrawImagePoints
GdipDrawImagePointsI
GdipDrawImagePointRect
GdipDrawImagePointRectI
GdipScaleWorldTransform
GdipDrawImagePointsRectI
GdipEnumerateMetafileDestPoint
GdipEnumerateMetafileDestPointI
GdipEnumerateMetafileDestPoints
GdipEnumerateMetafileDestPointsI
GdipEnumerateMetafileDestRect
GdipEnumerateMetafileDestRectI
GdipEnumerateMetafileSrcRectDestPoint
GdipEnumerateMetafileSrcRectDestPointI
GdipEnumerateMetafileSrcRectDestPoints
GdipEnumerateMetafileSrcRectDestPointsI
GdipEnumerateMetafileSrcRectDestRect
GdipEnumerateMetafileSrcRectDestRectI
GdipSetClipGraphics
GdipSetClipPath
GdipSetClipRect
GdipSetClipRectI
GdipSetClipRegion
GdipCreateFromHDC
GdipResetClip
GdipTranslateClip
GdipTranslateClipI
GdipGetClip
GdipGetClipBounds
GdipGetClipBoundsI
GdipGetVisibleClipBounds
GdipGetVisibleClipBoundsI
GdipIsClipEmpty
GdipIsVisibleClipEmpty
GdipIsVisiblePoint
GdipIsVisiblePointI
GdipIsVisibleRect
GdipIsVisibleRectI
GdipSaveGraphics
GdipRestoreGraphics
GdipBeginContainer
GdipBeginContainerI
GdipBeginContainer2
GdipEndContainer
GdipComment
GdipDeleteRegion
GdipCreateRegion
GdipCreateRegionRect
GdipCreateRegionRectI
GdipCreateRegionPath
GdipCreateRegionHrgn
GdipCreateRegionRgnData
GdipCloneRegion
GdipSetInfinite
GdipSetEmpty
GdipCombineRegionRect
GdipCombineRegionRectI
GdipCombineRegionRegion
GdipCombineRegionPath
GdipTranslateRegion
GdipTranslateRegionI
GdipTransformRegion
GdipGetRegionBounds
GdipGetRegionBoundsI
GdipGetRegionDataSize
GdipGetRegionData
GdipGetRegionHRgn
GdipIsEmptyRegion
GdipIsInfiniteRegion
GdipIsEqualRegion
GdipIsVisibleRegionPoint
GdipIsVisibleRegionPointI
GdipIsVisibleRegionRect
GdipIsVisibleRegionRectI
GdipGetRegionScansCount
GdipGetRegionScans
GdipGetRegionScansI
GdipTranslateWorldTransform
GdipMultiplyWorldTransform
GdipResetWorldTransform
GdipGetWorldTransform
GdipSetWorldTransform
GdipGetPixelOffsetMode
GdipSetPixelOffsetMode
GdipGetInterpolationMode
GdipSetInterpolationMode
GdipGetTextRenderingHint
GdipSetTextRenderingHint
GdipGetSmoothingMode
GdipSetSmoothingMode
GdipSetCompositingQuality
GdipGetCompositingQuality
GdipSetRenderingOrigin
GdipGetRenderingOrigin
GdipSetCompositingMode
GdipGetCompositingMode
GdipReleaseDC
GdipGetDC
GdipGetImageGraphicsContext
GdipDrawImagePointsRect
GdipCreateFromHDC2
GdipSetPenBrushFill
GdipSetPenColor
GdipGetPenColor
GdipTranslatePenTransform
GdipScalePenTransform
GdipRotatePenTransform
GdipMultiplyPenTransform
GdipResetPenTransform
GdipGetPenTransform
GdipSetPenTransform
GdipGetPenMode
GdipSetPenMode
GdipGetPenMiterLimit
GdipSetPenMiterLimit
GdipGetPenCustomEndCap
GdipSetPenCustomEndCap
GdipGetPenCustomStartCap
GdipSetPenCustomStartCap
GdipGetPenLineJoin
GdipSetPenLineJoin
GdipGetPenDashCap197819
GdipGetPenEndCap
GdipGetPenStartCap
GdipSetPenDashCap197819
GdipSetPenEndCap
GdipSetPenStartCap
GdipSetPenLineCap197819
GdipSetPenUnit
GdipGetPenUnit
GdipSetPenWidth
GdipGetPenWidth
GdipClonePen
GdipCreatePen2
GdipCreatePen1
GdipDeletePen
GdipFree
GdipAlloc
GdiplusStartup
GdipCreateFromHWND
GdipCreateFromHWNDICM
GdipFlush
GdipDeleteGraphics
GdipGetPenCompoundArray
GdipGetPenCompoundCount
GdipSetPenCompoundArray
GdipSetPenDashArray
GdipGetPenDashArray
GdipGetPenDashCount
GdipSetPenDashOffset
GdipGetPenDashOffset
GdipGetPenDashStyle
GdipSetPenDashStyle
GdipSetClipHrgn
GdipGetPenFillType
GdipDrawClosedCurve2I

ws2_32

gethostbyname
gethostname
sendto
recvfrom
htonl
inet_addr
connect
ntohs
getpeername
inet_ntoa
send
recv
select
__WSAFDIsSet
accept
closesocket
socket
htons
bind
listen
WSACleanup
WSAStartup
getsockname

Exports

Exports

_��ӳ��

Sections

.text
Size: - Virtual size: 134KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 664B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp2
Size: 144KB - Virtual size: 142KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a123be6c33d5cc41194f08b9d50f5ef8

Headers

File Characteristics

Imports

kernel32

user32

advapi32

gdiplus

ws2_32

Exports

Exports

Sections

.text Size: - Virtual size: 134KB

.rdata Size: - Virtual size: 11KB

.data Size: - Virtual size: 85KB

.rsrc Size: 4KB - Virtual size: 664B

.vmp0 Size: - Virtual size: 9KB

.vmp1 Size: - Virtual size: 54KB

.vmp2 Size: 144KB - Virtual size: 142KB

.reloc Size: 4KB - Virtual size: 112B

.text
Size: - Virtual size: 134KB

.rdata
Size: - Virtual size: 11KB

.data
Size: - Virtual size: 85KB

.rsrc
Size: 4KB - Virtual size: 664B

.vmp0
Size: - Virtual size: 9KB

.vmp1
Size: - Virtual size: 54KB

.vmp2
Size: 144KB - Virtual size: 142KB

.reloc
Size: 4KB - Virtual size: 112B