e173a146773afb6a756e834c3aa7590441c7f10bbbcae431971f994aa592b733

Sharing

Copy URL Twitter E-mail

General

Target

e173a146773afb6a756e834c3aa7590441c7f10bbbcae431971f994aa592b733
Size

2.1MB
MD5

c52451f4deada86de4bf99984b831f9c
SHA1

91542f3fcf0f64450dfa31ea4c29e95ea5348e6a
SHA256

e173a146773afb6a756e834c3aa7590441c7f10bbbcae431971f994aa592b733
SHA512

fc0961d2acd7e1a878e0da1f8e1c284a76b005e1b4c227a05adc902000f9f9a04c073acddee12d12938335638ba1580c9e338a2b1c73dbb434b2a40fe4f85f67
SSDEEP

49152:myaJiflHcOj43lUcDpQITPbwgRQnklFGpaqFrl:mdiflXW/pQKbBRQkH5erl

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

e173a146773afb6a756e834c3aa7590441c7f10bbbcae431971f994aa592b733
.exe windows x86

77f1188128b4608695044bc300374a91

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

FindFirstUrlCacheEntryA

kernel32

GetVersionExA
GetLocalTime
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

GetScrollInfo

gdi32

SetBkMode

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter

advapi32

RegCreateKeyA

shell32

SHGetSpecialFolderPathA

comctl32

_TrackMouseEvent

shlwapi

PathIsUNCA

oledlg

ord8

ole32

StgCreateDocfile

oleaut32

SysFreeString

urlmon

URLDownloadToFileA

wsock32

closesocket

winmm

PlaySoundA

Sections

.text
Size: - Virtual size: 355KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

77f1188128b4608695044bc300374a91

Headers

DLL Characteristics

File Characteristics

Imports

wininet

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

urlmon

wsock32

winmm

Sections

.text Size: - Virtual size: 355KB

.rdata Size: - Virtual size: 95KB

.data Size: - Virtual size: 79KB

.vmp0 Size: - Virtual size: 2.0MB

.vmp1 Size: 2.1MB - Virtual size: 2.1MB

.rsrc Size: 18KB - Virtual size: 17KB

.text
Size: - Virtual size: 355KB

.rdata
Size: - Virtual size: 95KB

.data
Size: - Virtual size: 79KB

.vmp0
Size: - Virtual size: 2.0MB

.vmp1
Size: 2.1MB - Virtual size: 2.1MB

.rsrc
Size: 18KB - Virtual size: 17KB