58527bc839188e3322704ba5e4e830046950333c39afa337d7b9bdfb46667550

Sharing

Copy URL Twitter E-mail

General

Target

58527bc839188e3322704ba5e4e830046950333c39afa337d7b9bdfb46667550
Size

4.4MB
MD5

16c4a90de7df8ae0a93a55cc2fc601d2
SHA1

d240ee67b47cd7eb72068baacf88e04af3cf1f38
SHA256

58527bc839188e3322704ba5e4e830046950333c39afa337d7b9bdfb46667550
SHA512

49327a8780ae97037aed3abb7d4fcb547159fd9d40a5785a6561927166aeac066dc2b1cbbfe9f78b5b59c955d7fb7f636e19bd09aba5dde80dd8beba7ae245eb
SSDEEP

98304:OCE+FcKa+CMoR45qtNIkmMjwCIFlZmZnXUJFTLHoI0EFU2CCux9h:OCE+FfWRuqtWMshyZnCIVMEN

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

58527bc839188e3322704ba5e4e830046950333c39afa337d7b9bdfb46667550
.exe windows x86

41bf20579f6d1dd2cbc8f290139c50f8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

winmm

waveOutGetNumDevs

ws2_32

send

rasapi32

RasHangUpA

kernel32

VirtualQuery
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

LoadImageA

gdi32

PtVisible

winspool.drv

ClosePrinter

advapi32

RegCreateKeyExA

shell32

Shell_NotifyIconA

ole32

OleRun

oleaut32

SafeArrayGetElement

comctl32

ImageList_Duplicate

wldap32

ord29

wininet

InternetCloseHandle

comdlg32

GetOpenFileNameA

Sections

.text
Size: - Virtual size: 961KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 3.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 352KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 841KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 4.4MB - Virtual size: 4.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

41bf20579f6d1dd2cbc8f290139c50f8

Headers

File Characteristics

Imports

winmm

ws2_32

rasapi32

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

wldap32

wininet

comdlg32

Sections

.text Size: - Virtual size: 961KB

.rdata Size: - Virtual size: 3.1MB

.data Size: - Virtual size: 352KB

.vmp0 Size: - Virtual size: 841KB

.vmp1 Size: 4.4MB - Virtual size: 4.4MB

.rsrc Size: 12KB - Virtual size: 11KB

.text
Size: - Virtual size: 961KB

.rdata
Size: - Virtual size: 3.1MB

.data
Size: - Virtual size: 352KB

.vmp0
Size: - Virtual size: 841KB

.vmp1
Size: 4.4MB - Virtual size: 4.4MB

.rsrc
Size: 12KB - Virtual size: 11KB