9c335d0de83b5ce9edb55b9c39c799f0ddeeceae96a6681dd9aeef96c74e3c74

Sharing

Copy URL Twitter E-mail

General

Target

9c335d0de83b5ce9edb55b9c39c799f0ddeeceae96a6681dd9aeef96c74e3c74
Size

43KB
MD5

61a61676e4a2b72ddb08da81c96f7490
SHA1

8df12c55dec948d28c535233aaade4f73265e912
SHA256

9c335d0de83b5ce9edb55b9c39c799f0ddeeceae96a6681dd9aeef96c74e3c74
SHA512

b8d5a48c8836aae38b9ffccd27defbea6b4b3015d74d579a0db011aa8f2fcacda8b39d8b3f9a0d54147e5ecfae647751a47c5490f1292a3cf5a7ddd74b4fbf08
SSDEEP

768:WQVhPI2Je4zRpp9TVrqvfkCfujymqsJx6+bHRa5Z4C:WQnQ2tdpp0fkCfujfqsJXbxa5Z4C

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

9c335d0de83b5ce9edb55b9c39c799f0ddeeceae96a6681dd9aeef96c74e3c74
.dll windows x86

d30b4aa43785eff03d2c6cfb22c4f58a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

MultiByteToWideChar
GlobalFree
GlobalUnlock
WriteFile
GlobalLock
GlobalAlloc
GetTempPathA
Process32Next
Process32First
CreateToolhelp32Snapshot
IsBadReadPtr
WideCharToMultiByte
GetCommandLineA
lstrcpyW
lstrlenW
CreateThread
DeleteFileA
GetModuleHandleA
SetFilePointer
GetModuleFileNameA
Module32First
CopyFileA
UnmapViewOfFile
MapViewOfFile
OpenFileMappingA
GetLastError
CreateMutexA
CreateRemoteThread
GetCurrentProcess
VirtualProtect
CreateFileA
ReadFile
GetFileSize
CloseHandle
GetTickCount
lstrcmpiA
lstrlenA
lstrcpynA
lstrcpyA
lstrcmpA
Sleep
ExitProcess
GetSystemDirectoryA
lstrcatA
LoadLibraryA
GetProcAddress
FreeLibrary
GetCurrentThreadId
OutputDebugStringA

user32

PostThreadMessageA
UnhookWindowsHookEx
SetWindowsHookExA
CallNextHookEx
EnumWindows
GetSystemMetrics
GetWindowTextA
IsWindowVisible
IsIconic
GetActiveWindow
ShowWindow
SetForegroundWindow
GetWindowInfo
PrintWindow
FindWindowA
FindWindowExA
GetWindowThreadProcessId
IsRectEmpty
ReleaseDC
GetDC

gdi32

GetDIBits
RealizePalette
SelectPalette
GetStockObject
GetObjectA
DeleteDC
GetDeviceCaps
CreateDCA
DeleteObject
BitBlt
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC

wininet

InternetSetOptionA
HttpAddRequestHeadersA
InternetQueryDataAvailable
InternetWriteFile
InternetReadFile
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
HttpSendRequestExA
InternetCloseHandle
InternetOpenA
HttpEndRequestA

netapi32

Netbios

gdiplus

GdipCloneImage
GdipDisposeImage
GdipFree
GdiplusStartup
GdipAlloc
GdipLoadImageFromFile
GdipSaveImageToFile
GdiplusShutdown
GdipGetImageEncodersSize
GdipGetImageEncoders

msvcrt

_except_handler3
sprintf
strrchr
memmove
??2@YAPAXI@Z
wcscmp
??3@YAXPAX@Z
malloc
free
strstr
atoi

dbghelp

ImageNtHeader

Exports

Exports

DeleteSelf
Hookoff
Hookon
KsCreateAllocator
KsCreateClock
KsCreatePin
KsCreateTopologyNode

Sections

.text
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d30b4aa43785eff03d2c6cfb22c4f58a

Headers

File Characteristics

Imports

kernel32

user32

gdi32

wininet

netapi32

gdiplus

msvcrt

dbghelp

Exports

Exports

Sections

.text Size: 18KB - Virtual size: 17KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 3KB - Virtual size: 17KB

.vmp0 Size: 2KB - Virtual size: 2KB

.vmp1 Size: 11KB - Virtual size: 11KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 18KB - Virtual size: 17KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 3KB - Virtual size: 17KB

.vmp0
Size: 2KB - Virtual size: 2KB

.vmp1
Size: 11KB - Virtual size: 11KB

.reloc
Size: 2KB - Virtual size: 1KB