715fb7cf60096a966db93e1bbe60cb6b836bbd2b0616252a4869f7548889b83f

Sharing

Copy URL Twitter E-mail

General

Target

715fb7cf60096a966db93e1bbe60cb6b836bbd2b0616252a4869f7548889b83f
Size

836KB
MD5

0b878a10145178f66c77ce099008fcfe
SHA1

9a3d27f9f10d00615a8addd49bcef14dd52d249d
SHA256

715fb7cf60096a966db93e1bbe60cb6b836bbd2b0616252a4869f7548889b83f
SHA512

d78e0ce8ebf4ec3a66541acd480ae31114846153f8ddca0f9866c5cab7ef14233d0e86480ab0ecc61883624f49a8ae5d52582a39b7eddb52542055984411ff3c
SSDEEP

24576:akV99KuXv6z3HMK4bxwTBm0LeA2XS1nLEJSkRG5L:akLfXv6THexELJ1nLIRG5

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

715fb7cf60096a966db93e1bbe60cb6b836bbd2b0616252a4869f7548889b83f
.dll windows x86

3a094f58d707ef57c8c2d7fc9685b72d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetVersion
GetVersionExA
GetVersion
CloseHandle
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

GetParent

advapi32

RegCloseKey

oleaut32

VariantInit

version

GetFileVersionInfoSizeA

gdi32

GetWinMetaFileBits

ole32

CoUninitialize

wininet

InternetOpenUrlA

comctl32

ImageList_GetImageCount

shell32

SHGetSpecialFolderLocation

comdlg32

PrintDlgA

winspool.drv

ClosePrinter

shfolder

SHGetFolderPathA

Exports

Exports

CPlApplet

Sections

CODE
Size: - Virtual size: 638KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 7KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 341KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 829KB - Virtual size: 828KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 232B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3a094f58d707ef57c8c2d7fc9685b72d

Headers

File Characteristics

Imports

kernel32

user32

advapi32

oleaut32

version

gdi32

ole32

wininet

comctl32

shell32

comdlg32

winspool.drv

shfolder

Exports

Exports

Sections

CODE Size: - Virtual size: 638KB

DATA Size: - Virtual size: 34KB

BSS Size: - Virtual size: 7KB

.idata Size: - Virtual size: 10KB

.edata Size: - Virtual size: 72B

.vmp0 Size: - Virtual size: 341KB

.vmp1 Size: 829KB - Virtual size: 828KB

.reloc Size: 512B - Virtual size: 232B

.rsrc Size: 6KB - Virtual size: 35KB

CODE
Size: - Virtual size: 638KB

DATA
Size: - Virtual size: 34KB

BSS
Size: - Virtual size: 7KB

.idata
Size: - Virtual size: 10KB

.edata
Size: - Virtual size: 72B

.vmp0
Size: - Virtual size: 341KB

.vmp1
Size: 829KB - Virtual size: 828KB

.reloc
Size: 512B - Virtual size: 232B

.rsrc
Size: 6KB - Virtual size: 35KB