7752186eb4bc21510b6e653bcbaf2aa08684aa192c648e21737b108d00f1098d

Sharing

Copy URL Twitter E-mail

General

Target

7752186eb4bc21510b6e653bcbaf2aa08684aa192c648e21737b108d00f1098d
Size

1.6MB
MD5

f7fc3e4825915022090d5cc3951fe0af
SHA1

304eca7e83948382336a9d8141b5bde5b67131d1
SHA256

7752186eb4bc21510b6e653bcbaf2aa08684aa192c648e21737b108d00f1098d
SHA512

ec8fef68c742c410ba2bd57d87fee94214593d0d79e812fc31f096d241580a4ea9ceee17fab4d6dc8a24f20841ee0cdf3118a7ed6599318bed9ad2ebbdbb250d
SSDEEP

49152:g/Sv0Q56vaV8bpwisC6HBFEW9pc7kwURFcY4:g/Gr5R+xsBhBjc7rURy

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

7752186eb4bc21510b6e653bcbaf2aa08684aa192c648e21737b108d00f1098d
.dll windows x86

97c955c517b687c328df2083943fedbf

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetCurrentThreadId
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess

user32

GetKeyboardType
MessageBoxA

advapi32

RegQueryValueExA

oleaut32

VariantChangeTypeEx

gdi32

UnrealizeObject

ole32

IsEqualGUID

comctl32

ImageList_SetIconSize

wsock32

WSACleanup

netapi32

Netbios

Sections

CODE
Size: - Virtual size: 443KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 569KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp1
Size: - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp2
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 196B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

97c955c517b687c328df2083943fedbf

Headers

File Characteristics

Imports

kernel32

user32

advapi32

oleaut32

gdi32

ole32

comctl32

wsock32

netapi32

Sections

CODE Size: - Virtual size: 443KB

DATA Size: - Virtual size: 10KB

BSS Size: - Virtual size: 569KB

.idata Size: - Virtual size: 9KB

.vmp0 Size: - Virtual size: 33KB

.rsrc Size: 4KB - Virtual size: 49KB

.vmp1 Size: - Virtual size: 1.2MB

.vmp2 Size: 1.6MB - Virtual size: 1.6MB

.reloc Size: 512B - Virtual size: 196B

CODE
Size: - Virtual size: 443KB

DATA
Size: - Virtual size: 10KB

BSS
Size: - Virtual size: 569KB

.idata
Size: - Virtual size: 9KB

.vmp0
Size: - Virtual size: 33KB

.rsrc
Size: 4KB - Virtual size: 49KB

.vmp1
Size: - Virtual size: 1.2MB

.vmp2
Size: 1.6MB - Virtual size: 1.6MB

.reloc
Size: 512B - Virtual size: 196B