8dc38dcd26c62e93c81e7f4408b83ec4d2adfe9a06cfebef0de945b338ec3c8b

Sharing

Copy URL

Twitter E-mail

General

Target

8dc38dcd26c62e93c81e7f4408b83ec4d2adfe9a06cfebef0de945b338ec3c8b
Size

5.6MB
MD5

67d697352c24fa1c30bd79bec7760f19
SHA1

6b59502ca2061177bbe65ed3d4957aeaf26ef309
SHA256

8dc38dcd26c62e93c81e7f4408b83ec4d2adfe9a06cfebef0de945b338ec3c8b
SHA512

7f91d4e09b069f48043b77de652d78c41e8e40e19ce135b783d63d101f1d14d02a15c1758bc68dc127b1e346f565f022a6e477d82031289d5a59d88fc7cfd1ef
SSDEEP

98304:sFUD9DTPp/Bf8rwHZw8C/ldAtIqDEmvLR6SJovBiJxiEBR:6UJ5BfbZ9CjAtdDLjVWvAJ7

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

8dc38dcd26c62e93c81e7f4408b83ec4d2adfe9a06cfebef0de945b338ec3c8b
.dll windows x64

5152ed3adc87d57df998f26d30602732

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

shlwapi

PathRemoveFileSpecA

user32

ShowWindow
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW

kernel32

ReadFile
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

wtsapi32

WTSSendMessageW

Exports

Exports

cef_api_hash
cef_execute_process
cef_get_path
cef_log
cef_post_task
cef_process_message_create
cef_string_list_alloc
cef_string_list_append
cef_string_list_free
cef_string_list_size
cef_string_list_value
cef_string_map_alloc
cef_string_map_append
cef_string_map_free
cef_string_map_key
cef_string_map_size
cef_string_map_value
cef_string_multimap_alloc
cef_string_multimap_append
cef_string_multimap_free
cef_string_multimap_key
cef_string_multimap_size
cef_string_multimap_value
cef_string_userfree_utf16_free
cef_string_utf16_clear
cef_string_utf16_cmp
cef_string_utf16_set
cef_string_utf16_to_utf8
cef_string_utf8_clear
cef_string_utf8_to_utf16
cef_v8context_get_current_context
cef_v8value_create_bool
cef_v8value_create_function
cef_v8value_create_int
cef_v8value_create_string

Sections

.text
Size: - Virtual size: 91KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 3.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 5.6MB - Virtual size: 5.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 188B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5152ed3adc87d57df998f26d30602732

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

user32

kernel32

wtsapi32

Exports

Exports

Sections

.text Size: - Virtual size: 91KB

.rdata Size: - Virtual size: 44KB

.data Size: - Virtual size: 7KB

.pdata Size: - Virtual size: 5KB

_RDATA Size: - Virtual size: 348B

.vmp0 Size: - Virtual size: 3.7MB

.vmp1 Size: 5.6MB - Virtual size: 5.6MB

.reloc Size: 512B - Virtual size: 188B

.text
Size: - Virtual size: 91KB

.rdata
Size: - Virtual size: 44KB

.data
Size: - Virtual size: 7KB

.pdata
Size: - Virtual size: 5KB

_RDATA
Size: - Virtual size: 348B

.vmp0
Size: - Virtual size: 3.7MB

.vmp1
Size: 5.6MB - Virtual size: 5.6MB

.reloc
Size: 512B - Virtual size: 188B