fffafe5e2f429851076e69119a5ab4970f9f76446fb1253ddc31549dee4de25b

Sharing

Copy URL Twitter E-mail

General

Target

fffafe5e2f429851076e69119a5ab4970f9f76446fb1253ddc31549dee4de25b
Size

1.1MB
MD5

0ecf3e59590dbb8711bd5de61ce13460
SHA1

c72a1120f6d6f5ad56deeda4add5ca47b0055ec5
SHA256

fffafe5e2f429851076e69119a5ab4970f9f76446fb1253ddc31549dee4de25b
SHA512

a44cd4d00f5f7966412c595df2edec93e7bcb2b856f28931f03f93c0a3f1d2361cefe2867a5ab1c473cb911a661374d5229d879b3a092a28b80f17cbb5cbe39c
SSDEEP

24576:PI47t+5Up3yeE9EYft0jRzbJskokljiMeEOC0UZJC8UsR3b:yM3y+osRzpoYGMeE93aT

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

fffafe5e2f429851076e69119a5ab4970f9f76446fb1253ddc31549dee4de25b
.exe windows x86

2ab972ed2177755aa11f089e4fdbd920

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mfc100

ord13972

msvcr100

_exit

kernel32

IsDebuggerPresent
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

AppendMenuA

gdi32

SelectObject

comctl32

InitCommonControlsEx

shlwapi

PathFindExtensionW

ole32

CoInitialize

oleaut32

GetErrorInfo

gdiplus

GdipCreateBitmapFromHBITMAP

msvcp100

?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ

ws2_32

getsockname

winmm

PlaySoundA

Sections

.text
Size: - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 69KB - Virtual size: 576KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: - Virtual size: 370KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp2
Size: 1010KB - Virtual size: 1009KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2ab972ed2177755aa11f089e4fdbd920

Headers

DLL Characteristics

File Characteristics

Imports

mfc100

msvcr100

kernel32

user32

gdi32

comctl32

shlwapi

ole32

oleaut32

gdiplus

msvcp100

ws2_32

winmm

Sections

.text Size: - Virtual size: 39KB

.rdata Size: - Virtual size: 16KB

.data Size: - Virtual size: 7KB

.rsrc Size: 69KB - Virtual size: 576KB

.vmp0 Size: - Virtual size: 8KB

.vmp1 Size: - Virtual size: 370KB

.vmp2 Size: 1010KB - Virtual size: 1009KB

.reloc Size: 512B - Virtual size: 184B

.text
Size: - Virtual size: 39KB

.rdata
Size: - Virtual size: 16KB

.data
Size: - Virtual size: 7KB

.rsrc
Size: 69KB - Virtual size: 576KB

.vmp0
Size: - Virtual size: 8KB

.vmp1
Size: - Virtual size: 370KB

.vmp2
Size: 1010KB - Virtual size: 1009KB

.reloc
Size: 512B - Virtual size: 184B