25920f7c76d2b1a2e930e715aa637bc6031f79f5af82c56e314f77fdd5f3f0de

Sharing

Copy URL

Twitter E-mail

General

Target

25920f7c76d2b1a2e930e715aa637bc6031f79f5af82c56e314f77fdd5f3f0de
Size

120KB
MD5

ddeaf23ab4dbcdff71ba3a8c47ac6280
SHA1

d71a2ce327c07e3e2f742d0b57ae4429d49c29e9
SHA256

25920f7c76d2b1a2e930e715aa637bc6031f79f5af82c56e314f77fdd5f3f0de
SHA512

badd59ea50299bb058d99d5a3b20ee08dadf3860592f05ae5744eec8e56164a911ecad3510cd68fa02dae64363b8e5a87b11d929a6793d115e0bfef45cd5daa8
SSDEEP

3072:U8br6KLnXnCUasJvM+mxxWXEoI5QX7c8f8M0BMiOCNn:9VLXnCkpGx6Ex67cT4

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs
Detects executables packed with VMProtect commercial packer.
vmprotect

Processes:

resource yara_rule

sample vmprotect

resource	yara_rule
sample	vmprotect

Files

25920f7c76d2b1a2e930e715aa637bc6031f79f5af82c56e314f77fdd5f3f0de
.dll windows x86

6e620463de6b9c34bd98c797bb554340

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCreateKeyExA

kernel32

GetCurrentProcessId
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

msvcrt

malloc

Exports

Exports

HidD_FlushQueue
HidD_FreePreparsedData
HidD_GetAttributes
HidD_GetConfiguration
HidD_GetFeature
HidD_GetHidGuid
HidD_GetIndexedString
HidD_GetInputReport
HidD_GetManufacturerString
HidD_GetMsGenreDescriptor
HidD_GetNumInputBuffers
HidD_GetPhysicalDescriptor
HidD_GetPreparsedData
HidD_GetProductString
HidD_GetSerialNumberString
HidD_Hello
HidD_SetConfiguration
HidD_SetFeature
HidD_SetNumInputBuffers
HidD_SetOutputReport
HidP_GetButtonCaps
HidP_GetCaps
HidP_GetData
HidP_GetExtendedAttributes
HidP_GetLinkCollectionNodes
HidP_GetScaledUsageValue
HidP_GetSpecificButtonCaps
HidP_GetSpecificValueCaps
HidP_GetUsageValue
HidP_GetUsageValueArray
HidP_GetUsages
HidP_GetUsagesEx
HidP_GetValueCaps
HidP_InitializeReportForID
HidP_MaxDataListLength
HidP_MaxUsageListLength
HidP_SetData
HidP_SetScaledUsageValue
HidP_SetUsageValue
HidP_SetUsageValueArray
HidP_SetUsages
HidP_TranslateUsagesToI8042ScanCodes
HidP_UnsetUsages
HidP_UsageListDifference
HidservInstaller

Sections

.text
Size: - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 976B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 296B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

vmp
Size: - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp2
Size: 117KB - Virtual size: 117KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6e620463de6b9c34bd98c797bb554340

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

Exports

Exports

Sections

.text Size: - Virtual size: 16KB

.data Size: - Virtual size: 1KB

.rsrc Size: 1024B - Virtual size: 976B

.vmp0 Size: - Virtual size: 296B

vmp Size: - Virtual size: 20KB

.vmp1 Size: - Virtual size: 70KB

.vmp2 Size: 117KB - Virtual size: 117KB

.reloc Size: 512B - Virtual size: 152B

.text
Size: - Virtual size: 16KB

.data
Size: - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 976B

.vmp0
Size: - Virtual size: 296B

vmp
Size: - Virtual size: 20KB

.vmp1
Size: - Virtual size: 70KB

.vmp2
Size: 117KB - Virtual size: 117KB

.reloc
Size: 512B - Virtual size: 152B