bce2cddd70e4cc90bbbd51091527640d3340b24bcbb61c85a50ba0a314ffee30

Sharing

Copy URL

Twitter E-mail

General

Target

bce2cddd70e4cc90bbbd51091527640d3340b24bcbb61c85a50ba0a314ffee30
Size

404KB
MD5

429738b982d4f37211d8313b983585fb
SHA1

c2a737f45c9522c93e6327160fc818ac472fccc3
SHA256

bce2cddd70e4cc90bbbd51091527640d3340b24bcbb61c85a50ba0a314ffee30
SHA512

71c95f777fc9f16638cac26b42d1ca69998e97b8ae52692c20831df18c5da368ffc968f56bb02a8adf7668eb0546fb4ad9d4ca904551410f90b3de2fd2222a95
SSDEEP

12288:/jtiB5cdsp4u9Tl/MqLmtGEuSYOxP5rWut9D:RiBXcGz5KP5LD

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

bce2cddd70e4cc90bbbd51091527640d3340b24bcbb61c85a50ba0a314ffee30
.dll windows x86

8af8d3c20503cc6efbe669f1e9dff1ef

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

MultiByteToWideChar
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess

setupapi

SetupDiGetClassDevsA

hid

HidD_GetHidGuid

Exports

Exports

Hid
HidD_FlushQueue
HidD_FreePreparsedData
HidD_GetAttributes
HidD_GetConfiguration
HidD_GetFeature
HidD_GetHidGuid
HidD_GetIndexedString
HidD_GetInputReport
HidD_GetManufacturerString
HidD_GetMsGenreDescriptor
HidD_GetNumInputBuffers
HidD_GetPhysicalDescriptor
HidD_GetPreparsedData
HidD_GetProductString
HidD_GetSerialNumberString
HidD_Hello
HidD_SetConfiguration
HidD_SetFeature
HidD_SetNumInputBuffers
HidD_SetOutputReport
HidP_GetButtonCaps
HidP_GetCaps
HidP_GetData
HidP_GetExtendedAttributes
HidP_GetLinkCollectionNodes
HidP_GetScaledUsageValue
HidP_GetSpecificButtonCaps
HidP_GetSpecificValueCaps
HidP_GetUsageValue
HidP_GetUsageValueArray
HidP_GetUsages
HidP_GetUsagesEx
HidP_GetValueCaps
HidP_InitializeReportForID
HidP_MaxDataListLength
HidP_MaxUsageListLength
HidP_SetData
HidP_SetScaledUsageValue
HidP_SetUsageValue
HidP_SetUsageValueArray
HidP_SetUsages
HidP_TranslateUsagesToI8042ScanCodes
HidP_UnsetUsages
HidP_UsageListDifference

Sections

.text
Size: - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: - Virtual size: 336KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 24B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp2
Size: 392KB - Virtual size: 391KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8af8d3c20503cc6efbe669f1e9dff1ef

Headers

File Characteristics

Imports

kernel32

setupapi

hid

Exports

Exports

Sections

.text Size: - Virtual size: 44KB

.rdata Size: - Virtual size: 10KB

.data Size: - Virtual size: 65KB

.vmp0 Size: - Virtual size: 6KB

.vmp1 Size: - Virtual size: 336KB

.tls Size: 4KB - Virtual size: 24B

.vmp2 Size: 392KB - Virtual size: 391KB

.reloc Size: 4KB - Virtual size: 192B

.text
Size: - Virtual size: 44KB

.rdata
Size: - Virtual size: 10KB

.data
Size: - Virtual size: 65KB

.vmp0
Size: - Virtual size: 6KB

.vmp1
Size: - Virtual size: 336KB

.tls
Size: 4KB - Virtual size: 24B

.vmp2
Size: 392KB - Virtual size: 391KB

.reloc
Size: 4KB - Virtual size: 192B