a0da51ca63f51ff519c35ac5dc8a4fe172b15eadfc00871f90ceb268baa1a07a

Sharing

Copy URL Twitter E-mail

General

Target

a0da51ca63f51ff519c35ac5dc8a4fe172b15eadfc00871f90ceb268baa1a07a
Size

302KB
MD5

2d5e3674673aee3b9f177e5f279bd161
SHA1

c218f559ffa25e1a178e709e37a425b55137cbad
SHA256

a0da51ca63f51ff519c35ac5dc8a4fe172b15eadfc00871f90ceb268baa1a07a
SHA512

d1645e2241d55da8dccd88b6648f1982cf8f60b49ca5cb0ce98ac62bab55a1554e56c37231a1e8574308bc9d79e2976903edd92f763e16414fcf400882d4d73a
SSDEEP

6144:opuqGHwFJ8J/J6uLUM0BN0RBx7qvmJo6G7EyGTke+ZUMdM:NaFk6uLUwBgMJyGTkP+M

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

a0da51ca63f51ff519c35ac5dc8a4fe172b15eadfc00871f90ceb268baa1a07a
.exe windows x86

1241d33376bc947e97f7640afc097855

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LeaveCriticalSection
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

shell32

ShellExecuteW

oleacc

LresultFromObject

user32

IsWindowEnabled

gdi32

ExtTextOutW

winspool.drv

ClosePrinter

oleaut32

VariantInit

Sections

.text
Size: - Virtual size: 108KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: - Virtual size: 137KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp2
Size: 253KB - Virtual size: 252KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1241d33376bc947e97f7640afc097855

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

shell32

oleacc

user32

gdi32

winspool.drv

oleaut32

Sections

.text Size: - Virtual size: 108KB

.rdata Size: - Virtual size: 26KB

.data Size: - Virtual size: 23KB

.rsrc Size: 48KB - Virtual size: 48KB

.vmp0 Size: - Virtual size: 26KB

.vmp1 Size: - Virtual size: 137KB

.vmp2 Size: 253KB - Virtual size: 252KB

.reloc Size: 512B - Virtual size: 176B

.text
Size: - Virtual size: 108KB

.rdata
Size: - Virtual size: 26KB

.data
Size: - Virtual size: 23KB

.rsrc
Size: 48KB - Virtual size: 48KB

.vmp0
Size: - Virtual size: 26KB

.vmp1
Size: - Virtual size: 137KB

.vmp2
Size: 253KB - Virtual size: 252KB

.reloc
Size: 512B - Virtual size: 176B