09342e5b817da7d66f0d72a30f05ac70a40fd513ecfedc4ddae629f08db13e9e

Sharing

Copy URL

Twitter E-mail

General

Target

09342e5b817da7d66f0d72a30f05ac70a40fd513ecfedc4ddae629f08db13e9e
Size

244KB
MD5

6f92c15bf863fa0e17a4e35bd4fd51fa
SHA1

6ca6a62a24bdaf0447fb9ae27f49253226cf9df8
SHA256

09342e5b817da7d66f0d72a30f05ac70a40fd513ecfedc4ddae629f08db13e9e
SHA512

fbb6db3add179bfe27d72fcefcfeeb05643e764be6c8064b7c99fd032ab6b2093a774550fb3ada2160fab2092b8e8b0766880a610548924383fc0a714a1faaba
SSDEEP

6144:fo6ZAZuWvOFBPbcLb4aVWKEyWLxkoXPVrFayCov9oTkN:g8WwA4ItJWlkOPVFSoVooN

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs
Detects executables packed with VMProtect commercial packer.
vmprotect

Processes:

resource yara_rule

sample vmprotect

resource	yara_rule
sample	vmprotect

Files

09342e5b817da7d66f0d72a30f05ac70a40fd513ecfedc4ddae629f08db13e9e
.exe windows x86

bb6967b4b01e1dfdc4070e67da00e6e4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrlenA
GetProcAddress
LoadLibraryA
GetVersionExA
LCMapStringA
SetEndOfFile
GetOEMCP
GetACP
GetCPInfo
GetModuleFileNameA
IsBadReadPtr
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
MoveFileA
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
IsBadWritePtr
VirtualAlloc
GetSystemDirectoryA
GetModuleHandleA
FreeResource
SetFilePointer
IsBadCodePtr
FlushFileBuffers
GetTempPathA
GetFileSize
ReadFile
GetLastError
CloseHandle
DeleteFileA
FindResourceA
LoadResource
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
HeapSize
GetVersion
GetCommandLineA
GetStartupInfoA
RtlUnwind
GetCurrentProcess
SizeofResource
LockResource
CreateFileA
WriteFile
SetStdHandle
TerminateProcess
ExitProcess
HeapReAlloc
HeapAlloc
HeapFree
LCMapStringW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

CreateWindowExA
GetClientRect
SetWindowTextA
UnregisterHotKey
KillTimer
RegisterHotKey
SetFocus
SetTimer
GetDlgItemTextA
keybd_event
GetDlgItem
SendMessageA
SetDlgItemTextA
MapVirtualKeyA
IsDlgButtonChecked
EndPaint
wsprintfA
EnableWindow
DialogBoxParamA
MessageBoxA
DestroyWindow
EndDialog
BeginPaint

gdi32

SetBkMode
SetTextColor
TextOutA
CreateFontIndirectA
SelectObject

advapi32

RegOpenKeyA
ControlService
CloseServiceHandle
OpenServiceA
OpenSCManagerA
AllocateAndInitializeSid
FreeSid
RegSetValueExA
RegCloseKey
CreateServiceA
StartServiceA
DeleteService

shell32

ShellExecuteA

ole32

CoInitialize
CoUninitialize

oleaut32

SysAllocString
VariantInit

wsock32

htonl

atl

ord47
ord42

comctl32

InitCommonControlsEx

winmm

timeBeginPeriod
timeEndPeriod

wininet

InternetReadFile
InternetOpenA
InternetSetOptionA
HttpQueryInfoA
HttpSendRequestA
HttpAddRequestHeadersA
HttpOpenRequestA
InternetConnectA
InternetCloseHandle
InternetOpenUrlA

Sections

.text
Size: - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 232KB - Virtual size: 229KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 234KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bb6967b4b01e1dfdc4070e67da00e6e4

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

wsock32

atl

comctl32

winmm

wininet

Sections

.text Size: - Virtual size: 40KB

.rdata Size: - Virtual size: 4KB

.data Size: - Virtual size: 18KB

.vmp0 Size: - Virtual size: 10KB

.vmp1 Size: 232KB - Virtual size: 229KB

.rsrc Size: 8KB - Virtual size: 234KB

.text
Size: - Virtual size: 40KB

.rdata
Size: - Virtual size: 4KB

.data
Size: - Virtual size: 18KB

.vmp0
Size: - Virtual size: 10KB

.vmp1
Size: 232KB - Virtual size: 229KB

.rsrc
Size: 8KB - Virtual size: 234KB