29ab884e5d369ac5ddbb1829eeb686ea30d106aa8c0748be8ccfad1a709793bc

Sharing

Copy URL Twitter E-mail

General

Target

29ab884e5d369ac5ddbb1829eeb686ea30d106aa8c0748be8ccfad1a709793bc
Size

404KB
MD5

a0c61c5725a1c0c25606222f1ae80308
SHA1

cb3c0348bb3b32bebb226dd66d25183289456aef
SHA256

29ab884e5d369ac5ddbb1829eeb686ea30d106aa8c0748be8ccfad1a709793bc
SHA512

bb7efd691814d25789fcba00c6c6feeb99f1e960f52d03523131e293b3fb542193e7664a205da4efba3968174dcf0c70646d18555b4dfef230661cbffe9f5a48
SSDEEP

6144:bRYrgSo9xnekApQfVTFch3DCi6D4Rs6kc+ECoDtkgPsUSAMnuQ2vln:bRSISsYhN6Dgs6kc+KtvmAMnuQIln

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

29ab884e5d369ac5ddbb1829eeb686ea30d106aa8c0748be8ccfad1a709793bc
.dll windows x86

2758e7639b51f9235e293af1da59c6d6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcmpA
LocalAlloc
LeaveCriticalSection
TlsGetValue
EnterCriticalSection
GlobalReAlloc
GlobalHandle
InitializeCriticalSection
TlsAlloc
TlsSetValue
LocalReAlloc
DeleteCriticalSection
TlsFree
CompareStringA
GetModuleHandleW
InterlockedIncrement
GetVersionExA
lstrcmpW
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
GlobalFlags
InterlockedExchange
GetLocaleInfoA
GetCPInfo
GetOEMCP
HeapAlloc
RtlUnwind
HeapFree
HeapReAlloc
GetSystemInfo
VirtualQuery
HeapSize
ExitProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
HeapDestroy
GetACP
IsValidCodePage
LCMapStringA
LCMapStringW
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTimeZoneInformation
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
SetStdHandle
GetConsoleOutputCP
WriteConsoleW
CompareStringW
SetEnvironmentVariableA
GlobalGetAtomNameA
GetCurrentThreadId
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
LocalFree
FreeLibrary
InterlockedDecrement
GetFileTime
GetFileSizeEx
GetFileAttributesA
FileTimeToLocalFileTime
FileTimeToSystemTime
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
ReadFile
GetThreadContext
Thread32Next
Thread32First
CreateToolhelp32Snapshot
GetLastError
MultiByteToWideChar
Sleep
CreateThread
CreateEventA
SetEvent
IsBadWritePtr
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
WaitForSingleObject
GetExitCodeThread
VirtualFreeEx
VirtualFree
VirtualAlloc
lstrlenA
WriteConsoleA
WriteFile
AllocConsole
GetStdHandle
SetConsoleMode
GetConsoleScreenBufferInfo
GetConsoleTitleA
SetConsoleTitleA
SetConsoleScreenBufferSize
SetConsoleWindowInfo
SetConsoleTextAttribute
GetCurrentDirectoryA
lstrcpyA
CreateDirectoryA
GetLocalTime
LoadResource
LockResource
SizeofResource
FindResourceA
RaiseException
LoadLibraryA
GetNativeSystemInfo
GetCommandLineA
IsBadReadPtr
SetLastError
lstrcmpiW
CreateNamedPipeA
CreateFileA
WideCharToMultiByte
GetModuleFileNameA
ReadProcessMemory
UnmapViewOfFile
GetModuleHandleA
GetProcAddress
VirtualProtect
GetTickCount
lstrcmpiA
VirtualQueryEx
CreateFileMappingA
MapViewOfFile
ResumeThread
OpenProcess
CloseHandle
GetCurrentProcessId
OutputDebugStringW
TerminateProcess
OutputDebugStringA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

PostQuitMessage
DestroyMenu
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
ClientToScreen
SetWindowTextA
RegisterWindowMessageA
LoadIconA
WinHelpA
GetCapture
GetClassLongA
GetClassNameA
SetPropA
RemovePropA
GetForegroundWindow
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetMenu
SetForegroundWindow
GetClientRect
CreateWindowExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
CopyRect
PtInRect
GetDlgCtrlID
DefWindowProcA
GetMenu
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetWindow
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
GetFocus
ModifyMenuA
EnableMenuItem
CheckMenuItem
LoadCursorA
GetPropA
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush
GetWindowTextA
SetWindowsHookExA
CallNextHookEx
DispatchMessageA
GetKeyState
PeekMessageA
ValidateRect
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
UnhookWindowsHookEx
CharUpperA
GetSystemMetrics
GetParent
GetLastActivePopup
EnableWindow
GetWindowLongA
SetWindowLongA
CallWindowProcA
PostMessageA
GetWindowThreadProcessId
SendMessageA
IsWindow
IsWindowEnabled
wsprintfA
GetLastInputInfo
wsprintfW
MessageBoxW
MessageBoxA
GetClassInfoExA

gdi32

DeleteDC
GetStockObject
RectVisible
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutA
GetDeviceCaps
PtVisible
SetMapMode
RestoreDC
SaveDC
DeleteObject
SetBkColor
SetTextColor
GetClipBox
CreateBitmap
TextOutA

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA
ClosePrinter
OpenPrinterA

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken

shlwapi

PathFindFileNameA
PathStripToRootA
PathIsUNCA

oleaut32

VariantInit
VariantClear
VariantChangeType

psapi

GetProcessImageFileNameA

dbghelp

ImageDirectoryEntryToData

ntdll

strstr
_wcsicmp
NtQueryVirtualMemory
RtlCaptureStackBackTrace
ZwQueryVirtualMemory
ZwSetContextThread
_strcmpi
sscanf

Exports

Exports

AntiLDRSetModuleInfo
SetWindow
_AntiHookCreateRmoterThread@8
_AntiHookCreateRmoterThreadEx@12
_AntiHookGetMainThreadId@0
_AntiHookGetProcAddress@8
_AntiHookGetProcAddressEx@8
_AntiHookGetProcAddressForTable@8
_AntiHookGetReturnAddress@4
_AntiHookGetSelfModuleByAddress@4
_AntiHookGetSelfModuleHandle@0
_AntiHookGetSelfModuleName@4
_AntiHookSetThreadToMain@0
_AntiHookSetToken@0

Sections

.text
Size: - Virtual size: 160KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 214KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 399KB - Virtual size: 399KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 140B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2758e7639b51f9235e293af1da59c6d6

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shlwapi

oleaut32

psapi

dbghelp

ntdll

Exports

Exports

Sections

.text Size: - Virtual size: 160KB

.rdata Size: - Virtual size: 33KB

.data Size: - Virtual size: 26KB

.vmp0 Size: - Virtual size: 214KB

.vmp1 Size: 399KB - Virtual size: 399KB

.reloc Size: 512B - Virtual size: 140B

.rsrc Size: 3KB - Virtual size: 11KB

.text
Size: - Virtual size: 160KB

.rdata
Size: - Virtual size: 33KB

.data
Size: - Virtual size: 26KB

.vmp0
Size: - Virtual size: 214KB

.vmp1
Size: 399KB - Virtual size: 399KB

.reloc
Size: 512B - Virtual size: 140B

.rsrc
Size: 3KB - Virtual size: 11KB