640ca5066401e717118f19e5e471ba8832d87e900205d8e5d6d10a53da51a913

Sharing

Copy URL

Twitter E-mail

General

Target

640ca5066401e717118f19e5e471ba8832d87e900205d8e5d6d10a53da51a913
Size

4.3MB
MD5

f7dbf6be3fc951697b713a286f4a6c48
SHA1

5b3eb15fefa4d8b546aa2987bcf36fcab901ae55
SHA256

640ca5066401e717118f19e5e471ba8832d87e900205d8e5d6d10a53da51a913
SHA512

340fde9e9c16eb9fe374930f6f247b4662ff1b2c20b10a03d093fad497b2367512d1908dbab9d790f86b2d4b8904950eef8d8de214626cab467c0c0a66a56477
SSDEEP

49152:PSvd6wMpY+mCvZhCCuLHy44COCVTVvoNVQCOeAYjLpT465SDEk2YBC3iMcoFntAe:+6wMa+5CCOqnDJ1jt86Qn26F+l/vw

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs
Detects executables packed with VMProtect commercial packer.
vmprotect

Processes:

resource yara_rule

sample vmprotect

resource	yara_rule
sample	vmprotect

Files

640ca5066401e717118f19e5e471ba8832d87e900205d8e5d6d10a53da51a913
.exe windows x86

9261647d966157c6b88c5725caad1813

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapAlloc
HeapFree
ExitThread
CreateThread
HeapReAlloc
GetCommandLineA
GetStartupInfoA
RtlUnwind
RaiseException
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapSize
SetStdHandle
GetFileType
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
VirtualFree
HeapCreate
GetStdHandle
GetACP
IsValidCodePage
GetStringTypeA
SetErrorMode
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetProcessHeap
CompareStringW
SetEnvironmentVariableA
GetFileTime
GetFileSizeEx
GetFileAttributesA
GetModuleHandleW
GetOEMCP
GetCPInfo
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
GlobalFlags
GetFullPathNameA
GetVolumeInformationA
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
InterlockedDecrement
GetModuleFileNameW
SuspendThread
SetThreadPriority
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
InterlockedExchange
GetThreadLocale
InterlockedIncrement
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetCurrentProcessId
FormatMessageA
MulDiv
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
CompareStringA
SetLastError
lstrcmpW
GetVersionExA
GlobalFree
ExitProcess
lstrlenA
WritePrivateProfileStringA
GetModuleFileNameA
GlobalUnlock
GlobalLock
GlobalAlloc
GetSystemDirectoryA
GetTickCount
FreeResource
WinExec
FileTimeToSystemTime
FileTimeToLocalFileTime
lstrcmpA
lstrcpyW
LocalFree
LocalAlloc
MultiByteToWideChar
FreeLibrary
MoveFileA
FlushFileBuffers
ReadFile
SetFilePointer
GetFileSize
LoadLibraryA
CopyFileA
CreateDirectoryA
FindClose
FindNextFileA
FindFirstFileA
FindResourceA
LoadResource
LockResource
SizeofResource
WideCharToMultiByte
WriteFile
CreateFileA
SetEvent
OpenEventA
WaitForSingleObject
CreateEventA
ResumeThread
GetLastError
CreateMutexA
CreateProcessA
DeleteFileA
GetTempPathA
GetCurrentProcess
GetCurrentDirectoryA
Sleep
MapViewOfFile
CreateFileMappingA
OutputDebugStringA
CreateRemoteThread
GetModuleHandleA
GetProcAddress
VirtualFreeEx
WriteProcessMemory
CloseHandle
GetStringTypeW
VirtualAllocEx
LoadLibraryA
GetProcAddress
GetLastError
FreeLibrary
InitializeCriticalSection
GetModuleFileNameW
GetModuleHandleW
TerminateProcess
GetCurrentProcess
DeleteCriticalSection
LoadLibraryW
CreateEventW
CompareStringW
SetLastError
GetModuleHandleA
VirtualProtect
GetTickCount
EnterCriticalSection
LeaveCriticalSection
VirtualFree
VirtualAlloc
WriteProcessMemory
CreateToolhelp32Snapshot
GetCurrentProcessId
GetCurrentThreadId
Thread32First
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
GetSystemInfo
LoadResource
MultiByteToWideChar
WideCharToMultiByte
FindResourceExW
FindResourceExA
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
HeapAlloc
HeapFree
HeapDestroy
HeapCreate
GetSystemTime
GetLocalTime
SystemTimeToFileTime
CompareFileTime
GetCommandLineA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
LCMapStringA
LCMapStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WriteFile
GetStdHandle
GetModuleFileNameA
RaiseException
Sleep
ExitProcess
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
HeapReAlloc
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
RtlUnwind
HeapSize
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
VirtualQuery
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

RegisterClipboardFormatA
UnregisterClassA
MessageBeep
GetNextDlgGroupItem
ReleaseCapture
SetCapture
InvalidateRgn
InvalidateRect
SetRect
IsRectEmpty
CopyAcceleratorTableA
LoadCursorA
GetSysColorBrush
DestroyMenu
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
SetCursor
GetMessageA
TranslateMessage
GetCursorPos
ValidateRect
SetWindowContextHelpId
MapDialogRect
PostQuitMessage
CharNextA
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
GetMenuState
EnableMenuItem
CheckMenuItem
ShowWindow
MoveWindow
SetWindowTextA
RegisterWindowMessageA
SendDlgItemMessageA
WinHelpA
IsChild
GetCapture
CallNextHookEx
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
GetFocus
SetFocus
GetWindowTextLengthA
GetWindowTextA
GetForegroundWindow
GetLastActivePopup
DispatchMessageA
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageA
MapWindowPoints
GetKeyState
SetMenu
SetForegroundWindow
IsWindowVisible
UpdateWindow
PostMessageA
GetSubMenu
GetMenuItemID
GetMenuItemCount
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
GetSysColor
AdjustWindowRectEx
EqualRect
PostThreadMessageA
IsDialogMessageA
CopyRect
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
PtInRect
GetMenu
SetWindowLongA
SetWindowPos
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetWindowRect
GetWindow
GetDesktopWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
IsWindow
GetWindowLongA
GetDlgItem
IsWindowEnabled
GetParent
GetNextDlgTabItem
EndDialog
RegisterHotKey
UnregisterHotKey
CharUpperA
LoadImageA
DrawIcon
GetClientRect
GetSystemMetrics
IsIconic
SendMessageA
LoadIconA
MessageBoxW
EnableWindow
MessageBoxA
GetWindowThreadProcessId
FindWindowA
wsprintfA
SetWindowsHookExA
MessageBoxW
CharUpperBuffW

gdi32

GetMapMode
GetRgnBox
CreateRectRgnIndirect
RectVisible
DeleteDC
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutA
PtVisible
GetWindowExtEx
GetViewportExtEx
DeleteObject
SetMapMode
RestoreDC
SaveDC
GetTextColor
GetBkColor
GetStockObject
GetDeviceCaps
CreateBitmap
GetObjectA
SetBkColor
SetTextColor
GetClipBox
TextOutA

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

advapi32

RegOpenKeyA
CreateServiceA
OpenProcessToken
LookupPrivilegeValueA
CloseServiceHandle
OpenSCManagerA
OpenServiceA
RegQueryValueA
RegEnumKeyA
RegDeleteKeyA
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegSetValueExA
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
StartServiceA
AdjustTokenPrivileges

shell32

SHGetMalloc
SHGetSpecialFolderLocation
SHGetPathFromIDListA
DragQueryFileA
DragFinish
Shell_NotifyIconA
ShellExecuteA

comctl32

ord17
InitCommonControlsEx

shlwapi

PathFindExtensionA
PathFindFileNameA
PathStripToRootA
PathIsUNCA
UrlUnescapeA

oledlg

ord8

ole32

StgOpenStorageOnILockBytes
CoRegisterMessageFilter
CoTaskMemFree
CoTaskMemAlloc
CLSIDFromProgID
CLSIDFromString
CoGetClassObject
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
CreateStreamOnHGlobal
CoCreateInstance
CoInitialize
OleFlushClipboard
OleIsCurrentClipboard
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoRevokeClassObject

oleaut32

SysAllocString
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroy
VariantCopy
OleCreatePictureIndirect
VariantClear
VariantChangeType
VariantInit
SysAllocStringLen
SysStringLen
SysFreeString
SysAllocStringByteLen
OleCreateFontIndirect

urlmon

URLDownloadToFileA

wsock32

WSASetLastError
WSACleanup
WSAStartup
htonl

wininet

InternetQueryDataAvailable
InternetCanonicalizeUrlA
InternetCrackUrlA
InternetCloseHandle
InternetReadFile
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallback
InternetGetLastResponseInfoA
HttpQueryInfoA
InternetOpenUrlA
InternetOpenA
InternetQueryOptionA

crypt32

CertFreeCertificateContext
CryptMsgClose
CertGetNameStringA
CryptDecodeObject
CertFindCertificateInStore
CryptQueryObject
CertCloseStore
CryptMsgGetParam

ntdll

RtlAdjustPrivilege
ZwOpenProcess
ZwAllocateVirtualMemory
ZwQuerySystemInformation
ZwFreeVirtualMemory
ZwDuplicateObject
ZwQueryInformationProcess
ZwClose

Sections

.text
Size: - Virtual size: 263KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 4.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 4.2MB - Virtual size: 4.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 180B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 152KB - Virtual size: 151KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9261647d966157c6b88c5725caad1813

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

urlmon

wsock32

wininet

crypt32

ntdll

Sections

.text Size: - Virtual size: 263KB

.rdata Size: - Virtual size: 66KB

.data Size: - Virtual size: 26KB

.vmp0 Size: - Virtual size: 4.2MB

.vmp1 Size: 4.2MB - Virtual size: 4.2MB

.reloc Size: 512B - Virtual size: 180B

.rsrc Size: 152KB - Virtual size: 151KB

.text
Size: - Virtual size: 263KB

.rdata
Size: - Virtual size: 66KB

.data
Size: - Virtual size: 26KB

.vmp0
Size: - Virtual size: 4.2MB

.vmp1
Size: 4.2MB - Virtual size: 4.2MB

.reloc
Size: 512B - Virtual size: 180B

.rsrc
Size: 152KB - Virtual size: 151KB