a38efaff6a514515472f6b8663631c31f7a32701e7344df48c804c411bbbfe2f

Sharing

Copy URL Twitter E-mail

General

Target

a38efaff6a514515472f6b8663631c31f7a32701e7344df48c804c411bbbfe2f
Size

2.5MB
MD5

6dbf6f453dbd071403890e321ea50140
SHA1

60a564e127c10ef3645d84036f75ab054f36678e
SHA256

a38efaff6a514515472f6b8663631c31f7a32701e7344df48c804c411bbbfe2f
SHA512

43b6b8070b313e6641a7ab44ee5ad2df0939b92812124c60eda3bb85d73dcb2d43590c514579e2593b15bc8cd9668fd7792f7b19e5456760846063ed73ac09cb
SSDEEP

49152:BBdV52nLRS2FTJq87h1VZnQ0JLhCEi4yCaYGAwMt3TrX4cqpOuWzGJqZLrz/YH5m:rdF2VJn1/lkE87pRI3/SpOuIGkZ/byQD

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

a38efaff6a514515472f6b8663631c31f7a32701e7344df48c804c411bbbfe2f
.dll windows x86

60209a194b51ad614cfc5ebc7243286f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

RtlUnwind
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess

user32

CreateMenu

gdi32

StretchBlt

winmm

waveOutUnprepareHeader

winspool.drv

DocumentPropertiesA

advapi32

RegQueryValueA

shell32

Shell_NotifyIconA

ole32

CLSIDFromString

oleaut32

LoadTypeLi

comctl32

ImageList_Destroy

ws2_32

recvfrom

comdlg32

GetOpenFileNameA

Exports

Exports

kjhkjhkjhkjmnbmn

Sections

.text
Size: - Virtual size: 505KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 150KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 4KB - Virtual size: 24B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp2
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

60209a194b51ad614cfc5ebc7243286f

Headers

File Characteristics

Imports

kernel32

user32

gdi32

winmm

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

ws2_32

comdlg32

Exports

Exports

Sections

.text Size: - Virtual size: 505KB

.rdata Size: - Virtual size: 89KB

.data Size: - Virtual size: 150KB

.rsrc Size: 8KB - Virtual size: 21KB

.vmp0 Size: - Virtual size: 67KB

.vmp1 Size: - Virtual size: 2.0MB

.tls Size: 4KB - Virtual size: 24B

.vmp2 Size: 2.5MB - Virtual size: 2.5MB

.reloc Size: 4KB - Virtual size: 148B

.text
Size: - Virtual size: 505KB

.rdata
Size: - Virtual size: 89KB

.data
Size: - Virtual size: 150KB

.rsrc
Size: 8KB - Virtual size: 21KB

.vmp0
Size: - Virtual size: 67KB

.vmp1
Size: - Virtual size: 2.0MB

.tls
Size: 4KB - Virtual size: 24B

.vmp2
Size: 2.5MB - Virtual size: 2.5MB

.reloc
Size: 4KB - Virtual size: 148B