5931586e55dea4f8f85a1767d90a8ed56afec3d04413573c85f32c2d10c14583

Sharing

Copy URL

Twitter E-mail

General

Target

5931586e55dea4f8f85a1767d90a8ed56afec3d04413573c85f32c2d10c14583
Size

2.4MB
MD5

b242e4b930901e8e0db343ecf54ab247
SHA1

3485907c13ca9327578f0699de3f4447c650606e
SHA256

5931586e55dea4f8f85a1767d90a8ed56afec3d04413573c85f32c2d10c14583
SHA512

5db51fde7cfc314ca081c5a9286c970481344460728061c637819f70f6ad19c277e4bff33704810d362c588fcb653d97aa674d1d4d1998a836fbb43b5c1d1478
SSDEEP

49152:xXv8RfxPn+Cy5nmyy90FJmVxpTZl6MfMf4AUf9UTKsNitrbzrdi:qRfxNy5myNYTTZU74Z6vNit/zrd

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs
Detects executables packed with VMProtect commercial packer.
vmprotect

Processes:

resource yara_rule

sample vmprotect

resource	yara_rule
sample	vmprotect

Files

5931586e55dea4f8f85a1767d90a8ed56afec3d04413573c85f32c2d10c14583
.exe windows x86

fd1e3769d50a04720fcbed17a0368ca5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

rasapi32

RasHangUpA

winmm

waveOutClose

ws2_32

WSACleanup

kernel32

GetVersionExA
GetVersion
GetModuleHandleA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

IsWindowVisible

gdi32

ScaleWindowExtEx

winspool.drv

DocumentPropertiesA

advapi32

RegCreateKeyExA

shell32

ShellExecuteA

ole32

CoFreeUnusedLibraries

oleaut32

LoadTypeLi

comctl32

ImageList_Destroy

oledlg

ord8

wininet

HttpOpenRequestA

comdlg32

ChooseColorA

Sections

.text
Size: - Virtual size: 549KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 309KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 942KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fd1e3769d50a04720fcbed17a0368ca5

Headers

File Characteristics

Imports

rasapi32

winmm

ws2_32

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

oledlg

wininet

comdlg32

Sections

.text Size: - Virtual size: 549KB

.rdata Size: - Virtual size: 1.6MB

.data Size: - Virtual size: 309KB

.vmp0 Size: - Virtual size: 942KB

.vmp1 Size: 2.4MB - Virtual size: 2.4MB

.rsrc Size: 20KB - Virtual size: 17KB

.text
Size: - Virtual size: 549KB

.rdata
Size: - Virtual size: 1.6MB

.data
Size: - Virtual size: 309KB

.vmp0
Size: - Virtual size: 942KB

.vmp1
Size: 2.4MB - Virtual size: 2.4MB

.rsrc
Size: 20KB - Virtual size: 17KB