6a4d35316e2c62afe56173926e82c6379b8eff4d007bd3f91bcbd3e53b80ad99

Sharing

Copy URL Twitter E-mail

General

Target

6a4d35316e2c62afe56173926e82c6379b8eff4d007bd3f91bcbd3e53b80ad99
Size

1.6MB
MD5

b382ea119e137f3640cc28417e2c5776
SHA1

f7eef045684873bbef934682aa54f5b086313db4
SHA256

6a4d35316e2c62afe56173926e82c6379b8eff4d007bd3f91bcbd3e53b80ad99
SHA512

0a3f4a5f6de2c2e74591780e390721f6895a5470c8f3338cc23630f432db2462296dde67f5409bcb87b1f369986d45d3bec133bd741ea43ff2ac2591348e4a3e
SSDEEP

49152:k9VtUFe6h0lBF8yuuG6rdiDq/wp+sQV7gKnRCvFt:k9VtUVh0lG6rVLNvRCvFt

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

6a4d35316e2c62afe56173926e82c6379b8eff4d007bd3f91bcbd3e53b80ad99
.exe windows x86

c89eccadbd9ce06a9092b84480166b78

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

gethostbyname

winmm

joyGetDevCapsA

version

VerQueryValueA

comctl32

ImageList_AddMasked

psapi

GetModuleBaseNameA

kernel32

GetVersionExA
LeaveCriticalSection
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

WindowFromPoint

gdi32

CreateSolidBrush

comdlg32

GetSaveFileNameA

advapi32

RegOpenKeyExA

shell32

ExtractIconA

ole32

CLSIDFromString

oleaut32

SysFreeString

Sections

.text
Size: - Virtual size: 587KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c89eccadbd9ce06a9092b84480166b78

Headers

File Characteristics

Imports

wsock32

winmm

version

comctl32

psapi

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: - Virtual size: 587KB

.rdata Size: - Virtual size: 57KB

.data Size: - Virtual size: 36KB

.vmp0 Size: - Virtual size: 1.3MB

.vmp1 Size: 1.6MB - Virtual size: 1.6MB

.rsrc Size: 59KB - Virtual size: 58KB

.text
Size: - Virtual size: 587KB

.rdata
Size: - Virtual size: 57KB

.data
Size: - Virtual size: 36KB

.vmp0
Size: - Virtual size: 1.3MB

.vmp1
Size: 1.6MB - Virtual size: 1.6MB

.rsrc
Size: 59KB - Virtual size: 58KB