5a1ba5714565092ad32b8896a2a18cabadaa860c144b50edebe866197a47b98b

Sharing

Copy URL

Twitter E-mail

General

Target

5a1ba5714565092ad32b8896a2a18cabadaa860c144b50edebe866197a47b98b
Size

2.3MB
MD5

aa377def304ae5a4f113ffb8191150eb
SHA1

37b49998913b10a0bae58fa511c33b10d99b3c7f
SHA256

5a1ba5714565092ad32b8896a2a18cabadaa860c144b50edebe866197a47b98b
SHA512

73f527a75ad001ed6f5862fd49ffff43cf3126c6c24ac0474614ef38de64290f5ce642490c08ba1287f6826feef84b5c290d5f0d31de5ee2bed45fe6508d5743
SSDEEP

49152:GGAIFSZvioLg7f0dbIJWNU/n/hMTv6kdypXDoBWAgM2u0IoIMzDigd:GhkSwoLSf0hIENWnJU6kmtAg/uZoIMzN

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs
Detects executables packed with VMProtect commercial packer.
vmprotect

Processes:

resource yara_rule

sample vmprotect

resource	yara_rule
sample	vmprotect

Files

5a1ba5714565092ad32b8896a2a18cabadaa860c144b50edebe866197a47b98b
.exe windows x86

0e91e31c3d79d78097cb1016c8068188

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

rasapi32

RasGetConnectStatusA

winmm

waveOutPause

ws2_32

recv

kernel32

GetVersionExA
GetVersion
LocalFree
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

SetRectEmpty

gdi32

SetTextColor

winspool.drv

OpenPrinterA

advapi32

RegOpenKeyExA

shell32

Shell_NotifyIconA

ole32

OleUninitialize

oleaut32

SafeArrayCreate

comctl32

ImageList_Destroy

oledlg

ord8

wininet

HttpSendRequestA

comdlg32

ChooseColorA

Sections

.text
Size: - Virtual size: 549KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 309KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 881KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0e91e31c3d79d78097cb1016c8068188

Headers

File Characteristics

Imports

rasapi32

winmm

ws2_32

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

oledlg

wininet

comdlg32

Sections

.text Size: - Virtual size: 549KB

.rdata Size: - Virtual size: 1.6MB

.data Size: - Virtual size: 309KB

.vmp0 Size: - Virtual size: 881KB

.vmp1 Size: 2.3MB - Virtual size: 2.3MB

.rsrc Size: 20KB - Virtual size: 17KB

.text
Size: - Virtual size: 549KB

.rdata
Size: - Virtual size: 1.6MB

.data
Size: - Virtual size: 309KB

.vmp0
Size: - Virtual size: 881KB

.vmp1
Size: 2.3MB - Virtual size: 2.3MB

.rsrc
Size: 20KB - Virtual size: 17KB