bf09910422bc2b93972d92416749f3292f7d62b752f22e6b020c4997f7e4f898

Sharing

Copy URL

Twitter E-mail

General

Target

bf09910422bc2b93972d92416749f3292f7d62b752f22e6b020c4997f7e4f898
Size

1.1MB
MD5

e1a9da163fdc214e6d99e227c1ae8e32
SHA1

f9beb7427af43c5f3e60d644fec7370e2957419c
SHA256

bf09910422bc2b93972d92416749f3292f7d62b752f22e6b020c4997f7e4f898
SHA512

901a70c673bd4a7287eaf6267c1cff0fdb4c9dde7157f85dddca248f8138029478fcc00c5eeadcd94dbeb3dae0e02cc7562d8660a2dfed47e1f2798634abef4f
SSDEEP

24576:H5/bRnxSAYkyNzOaV5Iexgo99pdHHDZFIjl9M:Z/ZYks7Dr993Hj7M

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs
Detects executables packed with VMProtect commercial packer.
vmprotect

Processes:

resource yara_rule

sample vmprotect

resource	yara_rule
sample	vmprotect

Files

bf09910422bc2b93972d92416749f3292f7d62b752f22e6b020c4997f7e4f898
.exe windows x86

80b24068f9f60b64c55b29772c833c5e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

rasapi32

RasHangUpA

kernel32

lstrcmpiA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess

user32

GetCursorPos
MessageBoxA

gdi32

GetSystemPaletteEntries

winmm

waveOutUnprepareHeader

winspool.drv

DocumentPropertiesA

advapi32

RegCreateKeyExA

shell32

ShellExecuteA

ole32

CLSIDFromProgID

oleaut32

VariantClear

comctl32

ord17

ws2_32

WSAAsyncSelect

wininet

HttpQueryInfoA

comdlg32

ChooseColorA

Sections

.text
Size: - Virtual size: 989KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 665KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 207KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 163KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

80b24068f9f60b64c55b29772c833c5e

Headers

File Characteristics

Imports

rasapi32

kernel32

user32

gdi32

winmm

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

ws2_32

wininet

comdlg32

Sections

.text Size: - Virtual size: 989KB

.rdata Size: - Virtual size: 665KB

.data Size: - Virtual size: 207KB

.rsrc Size: 12KB - Virtual size: 23KB

.vmp0 Size: - Virtual size: 163KB

.vmp1 Size: 1.1MB - Virtual size: 1.1MB

.reloc Size: 4KB - Virtual size: 176B

.text
Size: - Virtual size: 989KB

.rdata
Size: - Virtual size: 665KB

.data
Size: - Virtual size: 207KB

.rsrc
Size: 12KB - Virtual size: 23KB

.vmp0
Size: - Virtual size: 163KB

.vmp1
Size: 1.1MB - Virtual size: 1.1MB

.reloc
Size: 4KB - Virtual size: 176B